8.8 High Exploited

CVE-2016-7892 Adobe Flash Player Use-After-Free Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action The impacted product is end-of-life and should be disconnected if still in use.

Ransomware campaigns Not observed so far

Weakness CWE-416

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Affected products and versions

Product	Affected versions	Fixed in
Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier	Versions not published

References

SUSE-SU-2016:3148 lists.opensuse.org
MS16-154 docs.microsoft.com
GLSA-201701-17 security.gentoo.org
1037442 www.securitytracker.com
RHSA-2016:2947 rhn.redhat.com
helpx.adobe.com helpx.adobe.com
94877 www.securityfocus.com
openSUSE-SU-2016:3160 lists.opensuse.org

Timeline

Published December 15, 2016
Added to the KEV catalogue March 25, 2022
Last modified October 21, 2025

The 17 CVEs of Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier →

CVE-2016-7875 Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable integer overflow… Not rated CVE-2016-7869 Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow /… Not rated CVE-2016-7876 Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption… Not rated CVE-2016-7868 Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow /… Not rated

Track this CVE