CVE-2011-0609
Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.
Key facts
- CVSS score
- 7.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- EPSS score
- 63.5% (99th percentile)
- In CISA KEV
- Yes, added June 8, 2022
- In EU EUVD
- Yes (EUVD-2011-0627)
- Published
- March 15, 2011
- NVD last modified
- June 16, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Adobe Flash Player Unspecified Vulnerability
Added to the KEV catalog on June 8, 2022; federal remediation due June 22, 2022.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2011-0627 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.
View on the EU Vulnerability DatabaseAffected products
- adobe / acrobat
- adobe / acrobat
- adobe / acrobat
- adobe / acrobat reader
- adobe / acrobat reader
- adobe / acrobat reader
- adobe / air
- adobe / flash player
- apple / mac os x
- apple / macos
- google / android
- google / chrome
- google / chrome os
- linux / linux kernel
- microsoft / windows
- opensuse / opensuse
- opensuse / opensuse
- opensuse / opensuse
- oracle / solaris
- suse / linux enterprise
- suse / linux enterprise
References
- http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html(Broken Link)
- http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html(Mailing List, Third Party Advisory)
- http://secunia.com/advisories/43751(Broken Link)
- http://secunia.com/advisories/43757(Broken Link)
- http://secunia.com/advisories/43772(Broken Link)
- http://secunia.com/advisories/43856(Broken Link)
- http://securityreason.com/securityalert/8152(Broken Link)
- http://www.adobe.com/support/security/advisories/apsa11-01.html(Vendor Advisory)
- http://www.adobe.com/support/security/bulletins/apsb11-06.html(Not Applicable)
- http://www.kb.cert.org/vuls/id/192052(Third Party Advisory, US Government Resource)
- http://www.redhat.com/support/errata/RHSA-2011-0372.html(Broken Link)
- http://www.securityfocus.com/bid/46860(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1025210(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1025211(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1025238(Broken Link, Third Party Advisory, VDB Entry)
- http://www.vupen.com/english/advisories/2011/0655(Broken Link)
- http://www.vupen.com/english/advisories/2011/0656(Broken Link)
- http://www.vupen.com/english/advisories/2011/0688(Broken Link)
- http://www.vupen.com/english/advisories/2011/0732(Broken Link)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66078(Third Party Advisory, VDB Entry)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14147(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-0609(US Government Resource)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain