Exploitable NULL pointer deref could lead to arbitrary code execution
Published Oct 14, 2020
8.8
HIGHCVSS 3.1
EPSS 4.25%
Description
Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<=32.0.0.387
- Version unspecifiedStatusaffectedConstraints<=32.0.0.433
- Version unspecifiedStatusaffectedConstraints<=None
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | Flash Player | n/a |
|
Configuration 1
- ≤ 32.0.0.433
Configuration 2
- < 32.0.0.433
Configuration 3
- < 32.0.0.387
- < 32.0.0.387
Running on/with
- n/a
- n/a
No data.
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:32.0.0.445-1.el6_10
Fixed · RHSA-2020:4251
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 Supplementary | flash-plugin-0:32.0.0.445-1.el6_10 | Fixed | RHSA-2020:4251 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1 other source (CVE.org) ▾
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N/AC:M/Au:N/C:C/I:C/A:C
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Apr 23, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (20 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 4.25% (0.04255) | 90.76th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.24% (0.04244) | 89.72th | v5 (v2026.06.15) |
| Nov 21, 2025 | 1.67% (0.01670) | 81.55th | v4 (v2025.03.14) |
| Nov 18, 2025 | 3.71% (0.03712) | 86.79th | v4 (v2025.03.14) |
| Mar 30, 2025 | 1.03% (0.01029) | 75.32th | v4 (v2025.03.14) |
| Mar 29, 2025 | 2.56% (0.02559) | 75.80th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.98% (0.00985) | 75.25th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.64% (0.00644) | 79.97th | v3 (v2023.03.01) |
| Feb 16, 2024 | 0.55% (0.00546) | 76.76th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.43% (0.00430) | 73.75th | v3 (v2023.03.01) |
| Sep 20, 2023 | 0.43% (0.00430) | 71.43th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.41% (0.00407) | 70.53th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.51% (0.00510) | 72.95th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.28% (0.01282) | 67.73th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.28% (0.01282) | 65.24th | v2 (v2022.01.01) |
| Feb 4, 2022 | 31.33% (0.31326) | 96.46th | v2 (v2022.01.01) |
| Feb 3, 2022 | 13.33% (0.13332) | 89.07th | v1 |
| Jan 6, 2022 | 13.33% (0.13332) | 88.94th | v1 |
| Jan 5, 2022 | 3.31% (0.03315) | 82.12th | v5 (v2026.06.15) |
| Apr 14, 2021 | 3.31% (0.03315) | 0.00th | v1 |
References (5)
- https://access.redhat.com/security/cve/CVE-2020-9746 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1888018 Issue Tracking
- https://helpx.adobe.com/security/products/flash-player/apsb20-58.html x_refsource_MISCVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-9746
- https://www.cve.org/CVERecord?id=CVE-2020-9746
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-9746 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1888018 | Issue Tracking | |
| https://helpx.adobe.com/security/products/flash-player/apsb20-58.html | x_refsource_MISCVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-9746 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-9746 |
Change history (0)
No recorded changes yet.