PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2990 Adobe CVE debrief

CVE-2017-2990 is a high-severity Adobe Flash Player memory corruption issue in the H.264 decompression routine. NVD maps it to CWE-787 and a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-based exploitation that requires user interaction and can have major confidentiality, integrity, and availability impact. The supplied CPE data marks Flash Player in Chrome, Edge, Internet Explorer, and the desktop runtime as affected when running version 24.0.0.194 and earlier.

Vendor
Adobe
Product
Flash Player
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Security teams managing Adobe Flash Player deployments, especially browser-integrated and desktop runtime installations. End users and administrators should also pay attention because exploitation requires user interaction and could lead to arbitrary code execution.

Technical summary

The supplied NVD record describes an exploitable memory corruption flaw in Flash Player's H.264 decompression path. The weakness is classified as CWE-787. Affected CPE criteria in the source corpus include Flash Player variants for Chrome, Edge, Internet Explorer, and the desktop runtime at version 24.0.0.194 and earlier.

Defensive priority

High. The supplied data does not list this CVE in CISA KEV, but the combination of remote attack surface, user interaction requirement, and possible arbitrary code execution justifies prompt patching and exposure review.

Recommended defensive actions

  • Apply the Adobe security update referenced in APSB17-04 to all affected Flash Player installations.
  • Inventory Flash Player deployments, including browser-integrated copies in Chrome, Edge, and Internet Explorer, plus desktop runtime installs.
  • Prioritize remediation on systems that still allow Flash content or rely on legacy applications.
  • Use vendor and third-party advisories from Adobe, Red Hat, and Gentoo to confirm package-specific remediation steps.
  • Verify that systems no longer report Flash Player versions 24.0.0.194 or earlier.

Evidence notes

The supplied NVD record shows CVE-2017-2990 published on 2017-02-15 and modified on 2026-05-13. It references Adobe's APSB17-04 advisory, third-party advisories from Red Hat and Gentoo, and maps the weakness to CWE-787. The vulnerable CPE criteria in the source corpus specifically mark Flash Player versions 24.0.0.194 and earlier as affected.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2990 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2990

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2990 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2990

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.