Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
AnalysisAI
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute arbitrary code without user interaction. Confirmed actively exploited (CISA KEV) in May 2016 with public exploit code available. EPSS score of 92.76% (100th percentile) reflects the extreme likelihood of exploitation. This was a critical zero-day vulnerability used in targeted attacks before Adobe released emergency patches in APSA16-02 and APSB16-15.
Technical ContextAI
Adobe Flash Player is a deprecated multimedia runtime that executed ActionScript and rendered SWF content within web browsers and applications. The CPE data identifies the vulnerability affecting the Flash Player ActiveX control, NPAPI plugin, and Pepper API implementations across Windows, macOS, Linux, and ChromeOS platforms. Multiple CPE entries also indicate impacts to enterprise distributions including Red Hat Enterprise Linux 5/6 desktop, server, and workstation variants, plus OpenSUSE Evergreen 11.4, demonstrating the widespread deployment footprint. Without specific CWE classification, the root cause class remains unspecified in public data, though the 'unspecified vectors' language in the description combined with emergency patching suggests exploitation of a previously unknown code execution primitive in the Flash runtime, possibly related to ActionScript VM vulnerabilities, use-after-free conditions, or type confusion issues that were common in Flash Player vulnerabilities during this period.
RemediationAI
Vendor-released patch: Adobe Flash Player 21.0.0.242 for Desktop Runtime, Extended Support Release 18.0.0.352, and corresponding versions for all browser plugins as documented in APSB16-15. Organizations should immediately upgrade to the patched versions using Adobe's distribution channels or enterprise update mechanisms. Red Hat Enterprise Linux users should apply RHSA-2016-1079 via yum/dnf package managers. OpenSUSE users should apply security updates from announcements SUSE-SU-2016:1305, 1306, 1307, and 1308. Given Flash Player's end-of-life status (December 2020), the strongest long-term mitigation is complete Flash Player removal from all systems, which eliminates entire attack surface with no operational trade-offs for modern web applications. For legacy systems requiring Flash for specific business applications, implement strict application whitelisting allowing only trusted SWF content, deploy browser isolation technologies to sandbox Flash execution, and block Flash content at network perimeter using web proxies or content filters configured to drop .swf files and Flash MIME types. Network segmentation should isolate any systems requiring legacy Flash from internet-facing networks. These compensating controls significantly reduce attack surface but introduce operational complexity and may break legitimate functionality requiring case-by-case business justification.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Share
External POC / Exploit Code
Leaving vuln.today