Actively exploited · Published Nov 1, 2016 · Assigned by adobe
CVE-2016-7855
High 8.8 Exploited
In plain English
A high-severity use-after-free in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 25.2% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Mar 24, 2022.
Official description
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GLSA-201610-10 vendor-advisory, x_refsource_GENTOO
- MS16-128 vendor-advisory, x_refsource_MS
- 1037111 vdb-entry, x_refsource_SECTRACK
- https://helpx.adobe.com/security/products/flash-player/apsb16-36.html x_refsource_CONFIRM
- RHSA-2016:2119 vendor-advisory, x_refsource_REDHAT
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html x_refsource_MISC
- 93861 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7855 government-resource