CVE-2016-4117KEV · OVERDUE

Adobe Flash Player Arbitrary Code Execution Vulnerability

Critical · published May 11, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1673
days past CISA
deadline
CVSS v3.1
9.8
EPSS
94%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 Adobe Flash Player is wide open! A remote attacker can execute arbitrary code without breaking a sweat — like an unwanted guest crashing a party! 🎉 Imagine a hotel where anyone can check in without showing ID. That’s what this vulnerability does — it allows attackers to enter your system without permission and do whatever they want! If exploited, an attacker could take control of the system, resulting in data theft, malware installation, or complete system compromise. This isn’t just a nuisance; it could lead to significant data breaches or even ransomware situations, leaving users in a precarious position.

Put simply

Imagine a hotel where anyone can check in without showing ID. That’s what this vulnerability does — it allows attackers to enter your system without permission and do whatever they want! CVE-2016-4117 manifests in Adobe Flash Player 21.0.0.226 and earlier, allowing remote code execution via unidentified methods. This means that attackers can execute malicious code on the client’s machine without any user interaction.

What to do

If exploited, an attacker could take control of the system, resulting in data theft, malware installation, or complete system compromise. This isn’t just a nuisance; it could lead to significant data breaches or even ransomware situations, leaving users in a precarious position. To shield yourself from this vulnerability, update Adobe Flash Player to the latest version immediately. Consider disabling Flash entirely if it’s not essential for your use case, and regularly educate users about potential security threats from outdated software. You've got this! With a quick update, you’ll lock down your defenses and keep those digital party crashers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.94354 · 99.9th percentile
Published
2016-05-11T05:59Z
KEV added
2022-03-03 · due 2022-03-24
Affected products (16)
ProductVersionsFixed in
adobe/flash_player≤ 21.0.0.226—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_server_from_rhuiall versions—
redhat/enterprise_linux_server_from_rhuiall versions—
redhat/enterprise_linux_workstationall versions—
redhat/enterprise_linux_workstationall versions—
opensuse/evergreenall versions—
opensuse/opensuseall versions—
opensuse/opensuseall versions—
suse/linux_enterprise_desktopall versions—
suse/linux_enterprise_desktopall versions—
suse/linux_enterprise_workstation_extensionall versions—
suse/linux_enterprise_workstation_extensionall versions—
References (24)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-1079.html · [email protected]http://www.securityfocus.com/bid/90505 · [email protected]http://www.securitytracker.com/id/1035826 · [email protected]https://helpx.adobe.com/security/products/flash-player/apsa16-02.html · [email protected]https://helpx.adobe.com/security/products/flash-player/apsb16-15.html · [email protected]https://security.gentoo.org/glsa/201606-08 · [email protected]https://www.exploit-db.com/exploits/46339/ · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-1079.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/90505 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1035826 · af854a3a-2127-422b-91ae-364da2661108https://helpx.adobe.com/security/products/flash-player/apsa16-02.html · af854a3a-2127-422b-91ae-364da2661108https://helpx.adobe.com/security/products/flash-player/apsb16-15.html · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201606-08 · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/46339/ · af854a3a-2127-422b-91ae-364da2661108https://github.com/cisagov/vulnrichment/issues/196 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 11 MAY 01:00Z
    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016
    cvelistv5