CVE-2017-11292: Adobe Flash Player Type‑Confusion Vulnerability Enables Remote Code Execution
What It Is — Adobe Flash Player contains a type‑confusion flaw that can be triggered by malicious content to execute arbitrary code in the context of the user. The vulnerability is tracked as CVE‑2017‑11292.
Exploitability — The flaw is remotely exploitable; proof‑of‑concept code has been released and the CVSS v3.1 base score is 8.8 (High).
Affected Products — All Adobe Flash Player versions prior to the security update released in March 2017.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a robust vulnerability‑management control that continuously discovers, assesses, and remediates software flaws.
- Provides audit‑ready evidence that an organization is actively patching high‑risk components, a key signal for buyers demanding defensible security postures.
- Highlights the importance of maintaining an up‑to‑date software inventory and linking remediation actions to a single control objective that maps across SOC 2, ISO 27001, NIST CSF 2.0, and others.
Recommended Actions
- Inventory every endpoint that may still host Adobe Flash Player.
- Deploy Adobe’s March 2017 security update (or remove Flash entirely where feasible).
- Run an authenticated vulnerability scan to confirm remediation and capture scan reports as evidence of control execution.
- Map the remediation activity to the VCF “Vulnerability Management” control objective and store the evidence in your Trust Center for audit readiness.
Source: CISA KEV – CVE‑2017‑11292