How to Fix CVE-2012-0767: Universal XSS (UXSS) in Adobe Flash Player

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-06-08, federal due date 2022-06-22.

What is CVE-2012-0767?

CVE-2012-0767 is a cross-site scripting (XSS) flaw in Adobe Flash Player, classified by CISA as CWE-79. It is a specific, severe variant known as Universal XSS, or UXSS. Adobe's own advisory (APSB12-03) describes it bluntly: a maliciously crafted SWF file, loaded by a vulnerable Flash Player, could inject arbitrary web script or HTML into the context of any web page the victim was viewing.

The "universal" part is what makes UXSS worse than ordinary stored or reflected XSS. Classic XSS is confined to a single vulnerable site that fails to neutralize input. UXSS lives in the client-side runtime, here, the Flash plugin. so the attacker is not limited by one site's escaping bugs. A single hostile SWF served from any page (an ad slot, a forum signature, a compromised third-party widget) could run script as though it originated from a completely different origin, defeating the same-origin policy. That is why Adobe and CISA both treat a "medium" 6.1 score as something to remediate on an emergency timeline: the scope is CHANGED (S:C in the CVSS vector), meaning the impact crosses a security boundary.

The affected builds, straight from the MITRE record, are: Flash Player before 10.3.183.15, and the 11.x line before 11.1.102.62, on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x. Adobe shipped the fix on 2012-02-15, and it was already being exploited in the wild that same month.

Why this CVE matters

This is not a server-side, internet-facing service vulnerability. There is no daemon to firewall, no listening port to filter, and no Linux package on a server to patch. CVE-2012-0767 lives entirely on the endpoint, inside the Flash Player browser plugin that a user runs when they open a page containing Flash content. The attack is drive-by: the victim simply visits a page hosting a malicious SWF.

Because exploitation requires user interaction (UI:R in the CVSS vector, the victim has to load the hostile Flash content), but needs no privileges (PR:N) and is reachable over the network (AV:N), it was an ideal payload for malvertising and watering-hole campaigns in 2012. CISA later added it to the Known Exploited Vulnerabilities catalog on 2022-06-08, which is the authoritative confirmation that working attack code circulated. If you still have any machine running Flash Player older than the fixed builds, that endpoint is the exposure: not your servers.

Am I affected?

You are affected if a machine has Adobe Flash Player installed at a version below the fixed builds. Note that Flash Player ships in several flavors that update independently: the standalone NPAPI plugin (Firefox and older browsers), the ActiveX control (Internet Explorer), and the version bundled inside Chrome (Pepper/PPAPI). Check each one that is present.

The fastest authoritative check is Adobe's own version page, https://www.adobe.com/software/flash/about/, opened in each browser you use. It reports the exact Flash build that browser is running. To find installed copies on Windows from the command line:

# Windows: find the installed Flash Player plugin/ActiveX DLLs and read their version
Get-ChildItem "$env:SystemRoot\System32\Macromed\Flash","$env:SystemRoot\SysWOW64\Macromed\Flash" -Filter *.ocx -ErrorAction SilentlyContinue |
    ForEach-Object { [PSCustomObject]@{ File = $_.Name; Version = $_.VersionInfo.FileVersion } }
Get-ChildItem "$env:SystemRoot\System32\Macromed\Flash","$env:SystemRoot\SysWOW64\Macromed\Flash" -Filter NPSWF*.dll -ErrorAction SilentlyContinue |
    ForEach-Object { [PSCustomObject]@{ File = $_.Name; Version = $_.VersionInfo.FileVersion } }

# Linux: locate the NPAPI Flash plugin and print its embedded version string
find / -name "libflashplayer.so" 2>/dev/null
# The version is reported by the browser at chrome://version or about:plugins,
# or read it from the package manager if installed via a distro package:
rpm -q flash-plugin 2>/dev/null            # RHEL / openSUSE flash-plugin package
dpkg -l | grep -i flashplugin 2>/dev/null  # Debian / Ubuntu

If any reported build is below 10.3.183.15, or in the 11.x line below 11.1.102.62 (desktop), 11.1.111.6 (Android 2.x/3.x), or 11.1.115.6 (Android 4.x), that installation is vulnerable.

How to fix CVE-2012-0767

The fix is to update Adobe Flash Player to a patched build, or, far better in any modern environment. to remove Flash Player entirely. Adobe ended Flash Player support on 2020-12-31 and the runtime is now blocked in all major browsers, so for almost every reader the correct action in 2026 is uninstallation, not patching. The patched builds named in Adobe APSB12-03 are 10.3.183.15 for the 10.x line and 11.1.102.62 for the 11.x line on the desktop, with 11.1.111.6 and 11.1.115.6 for Android.

Best fix: uninstall Flash Player (Windows)

# Run as administrator. Removes the ActiveX, NPAPI, and PPAPI Flash installs.
# Adobe's official uninstaller is the cleanest path; download uninstall_flash_player.exe
# from https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html
Start-Process -FilePath "$env:USERPROFILE\Downloads\uninstall_flash_player.exe" -ArgumentList "-uninstall" -Wait

# Then remove any leftover plugin DLLs/OCX
Remove-Item "$env:SystemRoot\System32\Macromed\Flash\*","$env:SystemRoot\SysWOW64\Macromed\Flash\*" -Recurse -Force -ErrorAction SilentlyContinue

Best fix: remove the Flash plugin (Linux)

# Remove the distro-packaged plugin if present
sudo dnf remove flash-plugin            # RHEL / openSUSE (zypper rm flash-player-* on SUSE)
sudo apt-get remove flashplugin-installer browser-plugin-freshplayer-pepperflash   # Debian / Ubuntu

# And delete any manually-installed NPAPI plugin
sudo rm -f /usr/lib/mozilla/plugins/libflashplayer.so \
           /usr/lib64/mozilla/plugins/libflashplayer.so \
           ~/.mozilla/plugins/libflashplayer.so

If you must keep Flash: apply the vendor patch (distro packages)

The references on this CVE are distribution security advisories that rebuilt the Flash package against the fixed Adobe build. If you are pinned to Flash for a legacy application, install the patched package your distribution shipped:

# openSUSE, advisory openSUSE-SU-2012:0265
sudo zypper refresh && sudo zypper update flash-player

# Gentoo: advisory GLSA-201204-07
sudo emerge --sync && sudo emerge --ask --oneshot --verbose ">=www-plugins/adobe-flash-11.1.102.62"

# RHEL / CentOS, advisory RHSA-2012:0144 (flash-plugin via the Adobe channel)
sudo yum update flash-plugin

If you must keep Flash: update on Windows

# There is no Windows Update KB for the standalone Adobe Flash plugin in 2012;
# Flash updated itself or via the Adobe installer. Confirm the build after updating:
(Get-Item "$env:SystemRoot\SysWOW64\Macromed\Flash\NPSWF32*.dll").VersionInfo.FileVersion
# A patched desktop install reports 10.3.183.15 or 11.1.102.62 (or newer).

After updating or uninstalling, fully close and reopen every browser so no process keeps the old Flash module mapped in memory.

If you can't patch immediately

Because the vulnerability is in the client runtime and triggered by web content, the meaningful mitigations all reduce the chance a browser will load a malicious SWF. Network firewalls and WAF rules do nothing here. there is no server to protect.

• Disable the Flash plugin in every browser. Set it to click-to-play at minimum, or disable it outright. In 2026 every mainstream browser already blocks Flash, so this is usually already done for you.
• Use the Microsoft "kill bit" for the ActiveX control on Internet Explorer estates that cannot uninstall Flash, which prevents the control from instantiating in IE.
• Block Flash content at the proxy/content filter by stripping or denying application/x-shockwave-flash responses, so SWF files never reach endpoints.

# Windows: disable the Flash ActiveX control in Internet Explorer via the kill bit.
# CLSID for the Shockwave Flash Object ActiveX control:
$clsid = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"
$path  = "HKLM:\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\$clsid"
New-Item -Path $path -Force | Out-Null
# Compatibility Flags = 0x400 sets the kill bit
New-ItemProperty -Path $path -Name "Compatibility Flags" -Value 0x400 -PropertyType DWord -Force | Out-Null

These steps cut exposure but do not remove the flawed code. Updating or removing Flash Player is the only durable fix.

How to verify the fix worked

Confirm that Flash Player is either gone or reporting a patched build. The version string is the proof, it must be at or above the fixed release for your platform.

# Windows: should return nothing if Flash was uninstalled,
# or a version >= 11.1.102.62 / 10.3.183.15 if it was patched.
Get-ChildItem "$env:SystemRoot\System32\Macromed\Flash","$env:SystemRoot\SysWOW64\Macromed\Flash" -Filter *.* -ErrorAction SilentlyContinue |
    ForEach-Object { $_.VersionInfo.FileVersion }

# Linux: should return nothing after removal.
find / -name "libflashplayer.so" 2>/dev/null
rpm -q flash-plugin 2>/dev/null || echo "flash-plugin not installed"

Then open Adobe's Flash version page in each browser: it should report either no Flash present or the patched build. Finally, run an authenticated vulnerability scan with a current signature set and confirm it no longer flags CVE-2012-0767 on the host.

Frequently asked questions

What exactly does "Universal XSS" mean here, and why is it worse than normal XSS?

Normal XSS exploits a single website that fails to escape user input, and the injected script runs only in that site's origin. CVE-2012-0767 is a UXSS bug in the Flash Player runtime itself, so a malicious SWF can inject script that runs in the context of a different origin, bypassing the same-origin policy regardless of how carefully any individual site is coded. That is why the CVSS vector marks scope as CHANGED (S:C).

Which version fixes CVE-2012-0767?

On the desktop (Windows, macOS, Linux, Solaris), Flash Player 10.3.183.15 or 11.1.102.62 and later. On Android 2.x/3.x it is 11.1.111.6, and on Android 4.x it is 11.1.115.6. These are the builds named in Adobe security bulletin APSB12-03.

Do I even need to patch Flash in 2026, or should I just remove it?

Remove it. Adobe ended Flash Player support on 2020-12-31 and every major browser now blocks the runtime, so there is no reason to keep a 2012-era plugin installed. Uninstalling Flash eliminates this CVE and every later Flash vulnerability at once.

Will a firewall rule or WAF signature mitigate this?

No. This is an endpoint/browser-plugin vulnerability triggered by web content the user loads, not a server-side service. Server firewalls and WAFs have nothing to filter. The effective controls are disabling or removing the Flash plugin and blocking SWF content at the proxy.

References

• Official vendor advisory: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2012-0767
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0767
• Additional reference: http://security.gentoo.org/glsa/glsa-201204-07.xml
• Additional reference: http://secunia.com/advisories/48265
• Additional reference: http://www.adobe.com/support/security/bulletins/apsb12-03.html
• Additional reference: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2012-5054: Integer Overflow or Wraparound in Flash Player
• How to Fix CVE-2012-0754: Denial of Service in Flash Player
• How to Fix CVE-2012-1535: Code injection in Adobe Flash
• How to Fix CVE-2012-2034: Memory Corruption in Adobe Flash Player