CVE-2012-1535
HighExploitedPublic exploitflash-plugin: code execution flaw (APSB12-18)
Published Aug 14, 2012 · Updated Oct 22, 2025
Key Facts
Patch immediately- CVE-2012-1535 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Flash Player (Adobe), Opensuse, Enterprise Linux Desktop (Redhat) and 4 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 15, 2012. Public exploit code is available.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including Flash Player 11.3.300.271, flash-plugin 0:11.2.202.238-1.el5, flash-plugin 0:11.2.202.238-1.el6.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2012-1535 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 3, 2022 | Mar 24, 2022 | Not reported |
| Industry KEV feed | Aug 15, 2012 | Mar 24, 2022 | Not reported |
| CIRCL KEV | Mar 3, 2022 | Mar 24, 2022 | Not reported |
| ENISA EUVD | Mar 3, 2022 | n/a | Not reported |
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Affected Products
9 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Flash PlayerAdobe | See advisory | 11.3.300.271 |
| OpensuseOpensuse | 11.4, 12.1 | n/a |
| Enterprise Linux DesktopRedhat | 5.0 | n/a |
| Enterprise Linux ServerRedhat | 5.0 | n/a |
| Enterprise Linux WorkstationRedhat | 5.0 | n/a |
Patched Releases
Flash Player
11.3.300.271
flash-plugin
0:11.2.202.238-1.el5, 0:11.2.202.238-1.el6
Timeline
Publicly disclosed
Aug 14, 2012
Added to Industry KEV feed
Aug 15, 2012
Added to CISA KEV
Mar 3, 2022
Added to CIRCL KEV
Mar 3, 2022
Added to ENISA EUVD
Mar 3, 2022
Last updated
Oct 22, 2025
Weakness Type
- CWE-20 Improper Input Validation
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryopenSUSE-SU-2012:0996
- advisorySUSE-SU-2012:1001
- advisoryRHSA-2012:1203
- advisoryRHSA-2012:1173
- advisoryRHSA-2012:1203
FAQ
Common Questions.
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word doc…
Affected: Flash Player (Adobe); Opensuse versions 11.4, 12.1; Enterprise Linux Desktop (Redhat) versions 5.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 15, 2012.
Yes. It was added on Mar 3, 2022 with a federal remediation due date of Mar 24, 2022.
Public exploit code is available.
Fixed versions are available, including Flash Player 11.3.300.271, flash-plugin 0:11.2.202.238-1.el5, flash-plugin 0:11.2.202.238-1.el6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2012-1535 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo