Skip to content

CVE-2016-0984 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SD...

HighCVSS 8.8 EPSS 54.5% CISA KEV added 2022-05-25 · due 2022-06-15 Exploited in the wild
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

CISA Known Exploited Vulnerability

Date added
2022-05-25
Due date (FCEB)
2022-06-15
Ransomware use
Unknown

Required action

The impacted products are end-of-life and should be disconnected if still in use.

Affected products

ProductAffected versionsFixed in
Adobe flash player <= 20.0.0.272 No fix listed
Adobe flash player <= 11.2.202.559 No fix listed
Adobe flash player <= 18.0.0.326 No fix listed
Adobe flash player <= 20.0.0.286 No fix listed
Adobe flash player desktop runtime <= 20.0.0.286 No fix listed
Adobe air desktop runtime <= 20.0.0.233 No fix listed
Adobe air sdk <= 20.0.0.233 No fix listed
Adobe air sdk compiler <= 20.0.0.233 No fix listed

References