CVE-2016-7892
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Adobe Flash Player Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
Description
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 19% (percentile: 97) as of 1 November 2026
- CWE
- CWE-416
Affected products
adobe: flash player desktop runtime; apple: mac os x; microsoft: windows; adobe: flash player; microsoft: windows 10; microsoft: windows 8.1; google: chrome os; linux: linux kernel
References
- https://helpx.adobe.com/security/products/flash-player/apsb16-39.html PatchVendor Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb16-39.html PatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-1… PatchThird Party Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-1… PatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html Broken Link
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2016-2947.html Third Party Advisory
- http://www.securityfocus.com/bid/94877 Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037442 Broken LinkThird Party AdvisoryVDB Entry
- https://security.gentoo.org/glsa/201701-17 Third Party Advisory