CVE-2008-5363

no score yetEPSS 3.7%

adobe: no CVSS score yet. EPSS 3.7% chance of exploitation in the next 30 days.

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.

EPSS: 3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-399
Published: 2008-12-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

adobe:air
adobe:flash_player

References

http://secunia.com/advisories/33390
http://secunia.com/advisories/34226
http://security.gentoo.org/glsa/glsa-200903-23.xml
http://securityreason.com/securityalert/4692
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1

Check your stack JSON