CVE-2012-5054 Adobe Flash Player Integer Overflow

Exploited in the wild High 8.8 Published 24 Sep 2012 Updated 22 Oct 2025

Remote attackers can execute arbitrary code via malformed arguments exploiting an integer overflow in Adobe Flash Player.

Exploited in the wild: Since 8 Jun 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2012-5054?

CVE-2012-5054 is a high-severity vulnerability in Adobe Flash Player, published on 24 Sep 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

Weakness: CWE-190

Which versions are affected by CVE-2012-5054?

It affects 1 product.

Products include Adobe Flash Player.

How do I fix CVE-2012-5054?

Upgrade to a fixed version. US federal agencies must fix it by 22 Jun 2022.

Is CVE-2012-5054 being exploited?

Yes. Attackers have exploited CVE-2012-5054 in the wild since at least 8 Jun 2022.

All Adobe Flash Player vulnerabilities

Sources

Also known as GHSA-xxxm-q6xf-58pf.