CVE-2017-11292
ENISA EUVD: EUVD-2017-2926 ↗
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: March 3, 2026
2 articles
EPSS Score
Source: FIRST.org · 2026-05-24
34.96%
probability
This CVE has a 34.96% probability
of being exploited in the next 30 days.
0%
Top 97.1th percentile of all CVEs
100%
CVSS v3.1
Source: NVD8.8
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Project ZeroType confusion in TVSDK BufferControlParameters
Affected Products
Attack Intelligence
Google Project Zero
Discovered
Oct. 10, 2017
Patched
Oct. 16, 2017
Reported by
Anton Ivanov of Kaspersky Labs
Root Cause Analysis
???
Adobe Patches Flash Zero-Day Used by BlackOasis APT
BleepingComputer
Oct 16, 2017
Security Advisory 2017-022
CERT-EU
Oct 17, 2017
Signal Intelligence
Confidence
85%
EPSS
34.96%
CVSS v3.1
8.8
Mentions
2
Last Seen
Oct 17, 2017
CNA Information
Analyst Note
CVE-2017-11292 is confirmed as a critical zero-day affecting Adobe Flash Player with a high CVSS score of 8.8, demonstrated type confusion vulnerability leading to arbitrary code execution, and documented active exploitation reported by CERT-EU. The vulnerability's inclusion in Google Project Zero and CERT-EU security advisory provides strong corroboration of the threat despite limited public articles.
Triage Info
Decided atMar 03, 2026