PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2985 Adobe CVE debrief

CVE-2017-2985 is a high-severity Adobe Flash Player flaw in the ActionScript 3 BitmapData class. Adobe’s advisory and the NVD record describe it as a use-after-free (CWE-416) that can be exploited to achieve arbitrary code execution. The NVD record maps the issue to Flash Player versions 24.0.0.194 and earlier across the listed browser/runtime CPEs.

Vendor
Adobe
Product
CVE-2017-2985
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Teams still supporting legacy Adobe Flash Player deployments, especially browser-integrated Flash runtimes and desktop Flash Player installations at or below 24.0.0.194. Security teams should also care if they are auditing older endpoints, virtualized desktops, or archived application stacks that may still contain Flash components.

Technical summary

The vulnerability is a use-after-free in the ActionScript 3 BitmapData class, classified by NVD as CWE-416. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-based exploitation with required user interaction and potential for full compromise of confidentiality, integrity, and availability. NVD lists affected Flash Player variants ending at 24.0.0.194, including desktop runtime and browser-integrated builds.

Defensive priority

High. The combination of remote attack surface, required user interaction, and possible arbitrary code execution makes this a strong patch-and-retire priority for any remaining Flash exposure. Because Flash is a legacy product, removal or isolation is often more durable than relying only on version-based remediation.

Recommended defensive actions

  • Verify whether any endpoints, VDI images, kiosks, or legacy web apps still contain Adobe Flash Player 24.0.0.194 or earlier.
  • Apply the vendor remediation referenced by Adobe APSB17-04 where Flash is still present and supported in your environment.
  • Inventory browser-integrated Flash deployments separately from standalone desktop runtime installations, since both are represented in the NVD CPE data.
  • If Flash is no longer required, remove or disable it and replace dependent workflows with supported technologies.
  • Treat untrusted web content that can invoke Flash as higher risk on systems where Flash remains installed.
  • Use endpoint and browser inventory to confirm there are no residual installations in long-lived golden images or archived virtual machines.

Evidence notes

This debrief is based only on the supplied NVD source item and its linked official/vendor references. The NVD record states that Adobe Flash Player versions 24.0.0.194 and earlier are affected and identifies the weakness as CWE-416. The listed references include Adobe’s APSB17-04 advisory, third-party advisories, and an Exploit-DB entry; no exploit details are used here.

Official resources

Published in the supplied source corpus on 2017-02-15T06:59:00.557Z and modified on 2026-05-13T00:24:29.033Z. No KEV entry is listed in the supplied data.