CVE-2016-7892

Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

Published 15 Dec 2016 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

References

lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html · Broken Link
lists.opensuse.org/opensuse-updates/2016-12/msg00112.html · Broken Link
rhn.redhat.com/errata/RHSA-2016-2947.html · Third Party Advisory
www.securityfocus.com/bid/94877 · Third Party Advisory, VDB Entry
www.securitytracker.com/id/1037442 · Broken Link, Third Party Advisory, VDB Entry
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154 · Patch, Third Party Advisory
helpx.adobe.com/security/products/flash-player/apsb16-39.html · Patch, Vendor Advisory
security.gentoo.org/glsa/201701-17 · Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892 · US Government Resource