CVE-2016-4117

adobe flash player, redhat enterprise linux desktop, redhat enterprise linux server

Published 11 May 2016 · updated 10 Sept 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 24 Mar 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

References

lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2016-1079.html · Third Party Advisory
www.securityfocus.com/bid/90505 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1035826 · Broken Link, Third Party Advisory, VDB Entry
helpx.adobe.com/security/products/flash-player/apsa16-02.html · Broken Link, Vendor Advisory
helpx.adobe.com/security/products/flash-player/apsb16-15.html · Broken Link
security.gentoo.org/glsa/201606-08 · Third Party Advisory
www.exploit-db.com/exploits/46339/ · Exploit, Third Party Advisory, VDB Entry
github.com/cisagov/vulnrichment/issues/196 · Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117 · US Government Resource