CVE-2016-7892KEV · OVERDUE

Adobe Flash Player Use-After-Free Vulnerability

High · published December 15, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.3th percentile for exploit probability.

1651
days past CISA
deadline
CVSS v3.1
8.8
EPSS
19%
Percentile
97.3
In the wild
Confirmed
What it is

🚨 A sneaky use-after-free vulnerability in Adobe Flash Player has been identified, allowing attackers to exploit it for arbitrary code execution! ⚡ This is like a chef trying to use a knife that was already tossed in the trash — it's potentially dangerous and could lead to a catastrophic kitchen mishap if not handled correctly! If exploited, an attacker could run wild, executing any code they desire. This could lead to full system compromise, putting sensitive data and user systems in jeopardy. It’s a recipe for disaster! 🔥

Put simply

This is like a chef trying to use a knife that was already tossed in the trash — it's potentially dangerous and could lead to a catastrophic kitchen mishap if not handled correctly! This vulnerability occurs in the TextField class of Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier. It allows attackers to manipulate memory after it's been freed, leading to arbitrary code execution.

What to do

If exploited, an attacker could run wild, executing any code they desire. This could lead to full system compromise, putting sensitive data and user systems in jeopardy. It’s a recipe for disaster! 🔥 To protect yourself, update Adobe Flash Player to the latest version immediately. Ensure you have version 23.0.0.208 or higher, or 11.2.202.645 or higher. Regularly check for updates to ensure your software remains secure! 🛡️ You've got this! Stay proactive, and keep your systems secure! 💪🎉

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18786 · 97.3th percentile
Published
2016-12-15T06:31Z
KEV added
2022-03-25 · due 2022-04-15
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 15 DEC 06:31Z
    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class
    cvelistv5