CVE-2016-4171: Adobe Flash Player Remote Code Execution Vulnerability
Vulnerability summary
CVE-2016-4171 is a high (CVSS 10.0) vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 20.05% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 16-06-2016PublishedVulnerability first disclosed.
- 25-03-2022Added to CISA KEVAdobe Flash Player Remote Code Execution Vulnerability
- 15-04-2022CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
- 17-11-2025Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVSS metrics
5 scores · 3 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
20.05%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 20.05% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 25-03-2022
- Federal due date
- 15-04-2022
CISA required action
The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2016-4171
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat3 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_workstation5.0 | 6.0
Suse2 products
- linux_enterprise_desktop12 | 12:sp1
- linux_enterprise_workstation_extension12 | 12:sp1
Adobe1 product
- flash_player≤ 11.2.202.621 | ≤ 21.0.0.242 | ≤ 18.0.0.352
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.626ubuntu0.14.04.1 | < 11.2.202.626ubuntu0.16.04.1
5 vendors · 8 products
References
15 links- helpx.adobe.com/security/products/flash-player/apsa16-03.htmlX Refsource CONFIRMVendor AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 15 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171Government ResourceUS Government Resource
- github.com/cisagov/vulnrichment/issues/196Issue Tracking