Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-1096 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Adobe AIR Desktop Runtime

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer31 documents7 sources

Severity

9.8CRITICALNVD

NVD7.5CNA7.5OSV7.5

EPSS

39.7%

top 2.68%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Adobe AIR Desktop Runtime Adobe AIR SDK Adobe AIR SDK Compiler +3 more

Timeline

PublishedMay 11

Latest updateMay 14

Description

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages6 packages

▶NVDadobe/flash_player21.0.0.241+4

▶NVDadobe/flash_player_desktop_runtime21.0.0.226

▶NVDmicrosoft/internet_explorer10, 11+1

▶NVDadobe/air_sdk21.0.0.198

▶NVDadobe/air_sdk_compiler21.0.0.198

🔴Vulnerability Details

GHSA

GHSA-6gc7-g2p6-mq5h: Adobe Flash Player before 18↗2022-05-14

▶

GHSA

GHSA-6hcp-v9xq-2g4x: Adobe Flash Player before 18↗2022-05-14

▶

GHSA

GHSA-799p-jh5j-8wjj: Adobe Flash Player before 18↗2022-05-14

▶

GHSA

GHSA-8phf-322x-4vqr: Unspecified vulnerability in Adobe Flash Player 21↗2022-05-14

▶

GHSA

GHSA-3g5f-wchp-h22r: Adobe Flash Player before 18↗2022-05-14

▶

💥Exploits & PoCs

Exploit-DB

Adobe Flash - '.MP4' Stack Corruption↗2016-05-17

▶