CVE-2016-0984KEV · OVERDUE

Adobe Flash Player and AIR Use-After-Free Vulnerability

High · published February 10, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

1590
days past CISA
deadline
CVSS v3.1
8.8
EPSS
55%
Percentile
99.0
In the wild
Confirmed
What it is

🚨 A use-after-free vulnerability in Adobe Flash could let attackers execute arbitrary code, leaving your system wide open! 🔥 Think of it like a chef who accidentally leaves a recipe card on the counter. They might think they’ve finished with it, but someone could sneak in and use that recipe to whip up something entirely unexpected in the kitchen! An attacker could leverage this vulnerability to take control of your device, running their code as if they were you. This could lead to data theft, system compromise, or even a full takeover of the system, leaving your digital life in absolute shambles!

Put simply

Think of it like a chef who accidentally leaves a recipe card on the counter. They might think they’ve finished with it, but someone could sneak in and use that recipe to whip up something entirely unexpected in the kitchen! This use-after-free vulnerability arises when Adobe Flash Player mishandles memory, allowing attackers to exploit the freed memory space to execute arbitrary code.

What to do

An attacker could leverage this vulnerability to take control of your device, running their code as if they were you. This could lead to data theft, system compromise, or even a full takeover of the system, leaving your digital life in absolute shambles! Update Adobe Flash Player immediately to version 18.0.0.329 or later for Windows and OS X, and version 20.0.0.306 for Linux. If you're using Adobe AIR, ensure you're running version 20.0.0.260 or newer. Regularly check for updates to protect against potential exploits! You've got this! Follow these steps and let’s kick this vulnerability to the curb! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.54544 · 99.0th percentile
Published
2016-02-10T20:00Z
KEV added
2022-05-25 · due 2022-06-15
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 10 FEB 20:00Z
    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux…
    cvelistv5