Flash Player vulnerabilities are typically exploited over the web when users browse to compromised websites or load malicious advertisements. To protect themselves against browser-based attacks, users should enable click-to-play, a feature that blocks plug-in-based content like Flash from running automatically until the user clicks on it.
However, it's worth noting that attackers have also embedded Flash Player exploits into Word documents that were then sent as attachments via email. This embedded Flash content runs when the document is opened
