CVE-2016-0997

published 2016-03-12

CVE-2016-0997: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on…

Priority P2 70 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 20.0.0.233	—
adobe	air_desktop_runtime	<= 20.0.0.260	—
adobe	air_sdk	<= 20.0.0.260	—
adobe	air_sdk_compiler	<= 20.0.0.260	—
adobe	flash_player	<= 20.0.0.306	—
adobe	flash_player	<= 11.2.202.569	—
adobe	flash_player_desktop_runtime	<= 20.2.2.306	—
samsung	x14j_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39613.zip↗

filename crasher2.swf↗

• → Trigger involves calling MovieClip.swapDepths() with no arguments in ActionScript, causing alloca(0) to allocate an uninitialized 16-byte stack region that is subsequently accessed as a parameter. ↗
• → Exploit relies on a URL query parameter 'num' (0–31) to shift the native stack layout; varying this value produces crashes across different browser/Flash combinations. ↗
• → Crash sequence involves loading the malicious SWF twice in quick succession with different 'num' values (e.g., num=15 then num=4); monitor for rapid repeated SWF loads with varying query strings. ↗
• → The uninitialized stack memory contains a recognizable UTF string pattern ('fffff...') that may appear in crash dumps or memory forensics, aiding post-exploitation identification. ↗

• · The exploit is highly version-sensitive and described as 'finicky'; the specific stack layout and crash behavior depend on the exact Flash Player build in use. ↗
• · CVE-2016-0997 is listed as one of multiple distinct use-after-free vulnerabilities sharing the same advisory; detections should not conflate it with CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, or CVE-2016-1000. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

osv 8.8 HIGH

vendor_redhat 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416