Log in Start free

Actively exploited · Published Dec 15, 2016 · Assigned by adobe

CVE-2016-7892

High 8.8 Exploited

In plain English

A high-severity use-after-free in Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 19.1% (higher than 97% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)19.1%top 2.7% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Apr 15, 2022.

Official description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Affected products (as reported)

VendorProductVersions
n/a Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References