Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Adobe Flash Player lets attackers run code

CVE-2016-4272 · published 10 years ago
Summary

Versions of Adobe Flash Player for Windows, Mac and Linux before the updates listed can be tricked into running malicious code. This could let a hacker take control of the affected computer or steal data. Update Flash Player to the latest version or remove it if it is no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 11.2.202.632
<= 22.0.0.211
<= 18.0.0.366
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe flash_player_desktop_runtime <= 22.0.0.211
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitra...
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
6% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published14 Sep 2016
Updated1 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-4272 · NVD
Track software like this
Free during beta