Adobe · Flash Player and AIR
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
What it is
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
CISA: Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.
What to do
The impacted products are end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: June 15, 2022
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html
- security.gentoo.org/glsa/201603-07
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
- Added to the CISA list
- May 25, 2022
- Published
- March 12, 2016
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 19% in the top 2.7% of all known vulnerabilities
- Weakness
- CWE-190
- More details
- NVD · CVE.org · CISA
All references (8)
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html
- https://security.gentoo.org/glsa/201603-07
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
- http://www.securitytracker.com/id/1035251
- https://helpx.adobe.com/security/products/flash-player/apsb16-08.html
- http://www.securityfocus.com/bid/84308
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Use-After-Free | Flash Player and AIR | High 8.8 | 55% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Use-After-Free | Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 24, 2025 | Improper Input Validation | Commerce and Magento | Critical 9.1 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.