CVEvulnerability

CVE-2016-7892

8.8 HIGH Known exploited Published 2016-12-15 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Adobe Flash Player Use-After-Free Vulnerability — Adobe Flash Player

Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.

Added to KEV: 2022-03-25
Remediation due: 2022-04-15
Ransomware use: Unknown
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-7892

Status: Analyzed
Published: 2016-12-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses: CWE-416

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Affected configurations

• adobe flash player desktop runtime (<= 23.0.0.207) • adobe flash player (<= 23.0.0.207) • adobe flash player (<= 11.2.202.644)

Weakness · CWE (1)

CWE-416 Use After Free weakness

References