Is CVE-2011-0611 being actively exploited?

Yes. CVE-2011-0611 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 3, 2022.

What is the CVSS score for CVE-2011-0611?

CVE-2011-0611 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2011-0611

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 99.4%EU EUVD: exploited

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-843
EPSS score: 99.4% (100th percentile)
In CISA KEV: Yes, added March 3, 2022
In EU EUVD: Yes (EUVD-2011-0629)
Published: April 13, 2011
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Flash Player Remote Code Execution Vulnerability

Added to the KEV catalog on March 3, 2022; federal remediation due March 24, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2011-0629 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

adobe / acrobat
adobe / acrobat reader
adobe / adobe air
adobe / flash player
apple / mac os x
google / android
google / chrome
google / chrome os
linux / linux kernel
microsoft / windows
opensuse / opensuse
opensuse / opensuse
opensuse / opensuse
oracle / solaris
suse / linux enterprise desktop
suse / linux enterprise desktop

References

http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx(Not Applicable)
http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html(Exploit)
http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html(Exploit, Issue Tracking)
http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html(Release Notes)
http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00004.html(Mailing List, Patch)
http://secunia.com/advisories/44119(Broken Link, Vendor Advisory)
http://secunia.com/advisories/44141(Broken Link, Vendor Advisory)
http://secunia.com/advisories/44149(Broken Link, Vendor Advisory)
http://secunia.com/blog/210/(Broken Link, Vendor Advisory)
http://securityreason.com/securityalert/8204(Third Party Advisory)
http://securityreason.com/securityalert/8292(Third Party Advisory)
http://www.adobe.com/support/security/advisories/apsa11-02.html(Broken Link, Vendor Advisory)
http://www.adobe.com/support/security/bulletins/apsb11-07.html(Broken Link, Vendor Advisory)
http://www.adobe.com/support/security/bulletins/apsb11-08.html(Broken Link, Vendor Advisory)
http://www.exploit-db.com/exploits/17175(Exploit, Third Party Advisory, VDB Entry)
http://www.kb.cert.org/vuls/id/230057(Broken Link, Third Party Advisory, US Government Resource)
http://www.redhat.com/support/errata/RHSA-2011-0451.html(Broken Link, Vendor Advisory)
http://www.securityfocus.com/bid/47314(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1025324(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1025325(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2011/0922(Broken Link, Vendor Advisory)
http://www.vupen.com/english/advisories/2011/0923(Broken Link, Vendor Advisory)
http://www.vupen.com/english/advisories/2011/0924(Broken Link, Vendor Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/66681(Third Party Advisory, VDB Entry)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14175(Broken Link)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-0611(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain