CVE-2016-1010KEV · OVERDUE

Adobe Flash Player and AIR Integer Overflow Vulnerability

High · published March 12, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.3th percentile for exploit probability.

1590
days past CISA
deadline
CVSS v3.1
8.8
EPSS
19%
Percentile
97.3
In the wild
Confirmed
What it is

🚨 An integer overflow in Adobe Flash Player is a gateway for attackers — just like a sneaky backdoor that lets anyone stroll into your digital fortress! 🔥 Think of Adobe Flash Player like a high-security hotel. An integer overflow is like a double booking on a key card that lets an uninvited guest into a VIP suite without a reservation — and who knows what they might do once they’re in! This vulnerability could allow attackers to execute arbitrary code on your system, which means they could do anything from stealing sensitive data to completely taking over your machine! With a high CVSS score of 8.8, the threat is both serious and real. Don’t let these unwelcome guests crash your party!

Put simply

Think of Adobe Flash Player like a high-security hotel. An integer overflow is like a double booking on a key card that lets an uninvited guest into a VIP suite without a reservation — and who knows what they might do once they’re in! The integer overflow in Adobe Flash Player creates an opportunity for attackers to exploit unspecified vectors, enabling them to run arbitrary code on affected systems. This flaw exists in versions prior to 18.0.0.333, 19.x through 21.x before 21.0.0.182, and specific versions of Adobe AIR.

What to do

This vulnerability could allow attackers to execute arbitrary code on your system, which means they could do anything from stealing sensitive data to completely taking over your machine! With a high CVSS score of 8.8, the threat is both serious and real. Don’t let these unwelcome guests crash your party! To protect yourself, immediately update Adobe Flash Player to version 21.0.0.182 or later on Windows and OS X, and to version 11.2.202.577 on Linux. Also, ensure Adobe AIR is updated to version 21.0.0.176 or higher. Don't leave security to chance! You've got this! Update those versions and keep your digital fortress secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.19333 · 97.3th percentile
Published
2016-03-12T15:00Z
KEV added
2022-05-25 · due 2022-06-15
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 12 MAR 15:00Z
    Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe…
    cvelistv5