Adobe Flash Player Use-After-Free Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2016-7892 · Published 15/12/2016 · updated 17/06/2026

Adobe Flash Player Use-After-Free Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
flash player adobe	`≤ 11.2.202.644≤ 23.0.0.207`	No fix yet
flash player desktop runtime adobe	`≤ 23.0.0.207`	No fix yet

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

References

lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html · Broken Link
lists.opensuse.org/opensuse-updates/2016-12/msg00112.html · Broken Link
rhn.redhat.com/errata/RHSA-2016-2947.html · Third Party Advisory
securityfocus.com/bid/94877 · Third Party Advisory
securitytracker.com/id/1037442 · Broken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154 · Patch
helpx.adobe.com/security/products/flash-player/apsb16-39.html · Patch
security.gentoo.org/glsa/201701-17 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2016-7892

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free