Adobe · Flash Player and AIR
CVE-2016-0984
Adobe Flash Player and AIR Use-After-Free Vulnerability
What it is
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
CISA: Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
What to do
The impacted products are end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- February 10, 2016
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 55% in the top 1.0% of all known vulnerabilities
- Weakness
- CWE-416
- More details
- NVD · CVE.org · CISA
All references (9)
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00027.html
- https://security.gentoo.org/glsa/201603-07
- http://rhn.redhat.com/errata/RHSA-2016-0166.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00025.html
- https://www.exploit-db.com/exploits/39462/
- http://www.securitytracker.com/id/1034970
- https://helpx.adobe.com/security/products/flash-player/apsb16-04.html
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Integer Overflow | Flash Player and AIR | High 8.8 | 19% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Use-After-Free | Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 24, 2025 | Improper Input Validation | Commerce and Magento | Critical 9.1 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.