CVE-2016-0959

Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe…

published June 27, 2017

CVSS
—
EPSS
5%
Percentile
92.4
In the wild
Unconfirmed
What it is

⚠️ This one’s a classic case of use-after-free lurking in Adobe Flash Player — like a mischievous ghost that keeps haunting your system even after you think you’ve banished it! 👻 Imagine a librarian who keeps a book on the shelf long after it’s been checked out. When someone tries to borrow it again, chaos ensues because the book is still listed as available! That’s kind of how this vulnerability works when memory is mishandled. An attacker could exploit this vulnerability to execute arbitrary code in the context of the user, potentially compromising the entire system. While there are no known exploits in the wild, the mere possibility of unbridled access could leave sensitive information exposed or allow for further malicious actions.

Put simply

Imagine a librarian who keeps a book on the shelf long after it’s been checked out. When someone tries to borrow it again, chaos ensues because the book is still listed as available! That’s kind of how this vulnerability works when memory is mishandled. The use-after-free vulnerability occurs when Adobe Flash Player fails to properly manage memory, allowing attackers to access and manipulate already-released memory objects. This can lead to unpredictable behavior, including arbitrary code execution.

What to do

An attacker could exploit this vulnerability to execute arbitrary code in the context of the user, potentially compromising the entire system. While there are no known exploits in the wild, the mere possibility of unbridled access could leave sensitive information exposed or allow for further malicious actions. Update to Adobe Flash Player version 20.0.0.267 or later for desktop and browser versions. For AIR Desktop Runtime and SDK, ensure you're on version 20.0.0.233 or later. Regularly check for updates to keep your software secure! You've got this! Staying updated is your best defense. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05205 · 92.4th percentile
Published
2017-06-27T20:00Z
EPSS history
Timeline
  • 27 JUN 20:00Z
    Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe…
    cvelistv5