CVE-2014-0558: Critical – Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before

CWE Weakness Definitions

CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)

CAPEC-35 Leverage Executable Code in Non-Executable Files

via CWE-94

CAPEC-77 Manipulating User-Controlled Variables

via CWE-94

CAPEC-242 Code Injection

via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2014. A critical vulnerability affects Adobe systems (CVE-2014-0558). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2014-GLOBAL-267635-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2014-0558?

This vulnerability was disclosed in 2014. A critical vulnerability affects Adobe systems (CVE-2014-0558). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2014-0558?

CVE-2014-0558 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 5.1%.

Is CVE-2014-0558 actively exploited?

No confirmed active exploitation of CVE-2014-0558 as of 2026-09-25.

How do I remediate CVE-2014-0558?

Priority: MEDIUM. Advisory: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html PSIRT: [email protected]

What systems are affected by CVE-2014-0558?

CVE-2014-0558 affects Adobe Flash Player, Adobe Air, Adobe Air Sdk.

Vulnerability Details

CVE ID	`CVE-2014-0558`
BSID	`BS-2014-GLOBAL-267635-C` BreachSpider Global ID
CVSS Vector	`AV:N/AC:L/Au:N/C:C/I:C/A:C`
Published	2014-10-15
Last Modified	2026-06-17
ICS Relevance	15%
Weakness (CWE)	Code Injection
Source	NVD

Official Description

Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Adobe	Flash Player	`14.0.0.125` `14.0.0.145` `14.0.0.176` `14.0.0.179` `15.0.0.144` `15.0.0.152` +1 more `≤ 13.0.0.244`
Adobe	Adobe Air	`≤ 15.0.0.252`
Adobe	Adobe Air Sdk	`≤ 15.0.0.249`

Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Apple Mac Os X, Linux Linux Kernel, Microsoft Windows

Remediation

View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 4383 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`b11ca18a1dd4ad2746871f60d32610830bb7ba096bc6b5f9478df10536781768d63be3a0c40db43cdbf307dc8c845daac262b347187036e5b3e5478a9953ca0e`

Related CVEs affecting Adobe

CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2015-8408 10.0 Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on W... CVE-2015-6687 10.0 Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 ... CVE-2015-6684 10.0 Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 ... CVE-2015-0339 10.0 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 ...

View all Adobe CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →