Log in Start free

Actively exploited · Published Feb 10, 2016 · Assigned by adobe

CVE-2016-0984

High 8.8 Exploited

In plain English

A high-severity use-after-free in Flash Player and AIR from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 54.5% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. The impacted products are end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)54.5%top 1.0% of all CVEs
Exploited in the wildYesCISA KEV since May 25, 2022
Attack tooling1Public PoC

CISA guidance

The impacted products are end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Jun 15, 2022.

Official description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References