CVE-2016-4117: Adobe Flash Player Arbitrary Code Execution Vulnerability
Vulnerability summary
CVE-2016-4117 is a high (CVSS 10.0) vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 03-03-2022. It has been used in ransomware campaigns. EPSS estimates a 94.35% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 11-05-2016PublishedVulnerability first disclosed.
- 03-03-2022Added to CISA KEVAdobe Flash Player Arbitrary Code Execution Vulnerability
- 24-03-2022CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS metrics
5 scores · 3 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
94.35%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 94.35% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2022
- Federal due date
- 24-03-2022
CISA required action
The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2016-4117
Public exploits
2 foundAdobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)
Maturity: weaponized
Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion
exploit/osx/browser/adobe_flash_delete_range_tl_op
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat4 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_server_from_rhui5.0 | 6.0
- enterprise_linux_workstation5.0 | 6.0
Suse2 products
- linux_enterprise_desktop12 | 12:sp1
- linux_enterprise_workstation_extension12 | 12:sp1
Adobe1 product
- flash_player≤ 21.0.0.226
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.621ubuntu0.14.04.1 | < 11.2.202.621ubuntu0.16.04.1
5 vendors · 10 products
References
16 links- lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- helpx.adobe.com/security/products/flash-player/apsa16-02.htmlX Refsource CONFIRMBroken LinkVendor AdvisoryREPORT
Show all 16 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117Government ResourceUS Government Resource
- github.com/cisagov/vulnrichment/issues/196Issue Tracking