cbcvebase.
CVE-2016-1096
published 2016-05-11

CVE-2016-1096: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and…

PriorityP263high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
39.65%
98.4th percentile
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

Affected

11 ranges
VendorProductVersion rangeFixed in
adobeair_desktop_runtime<= 21.0.0.198
adobeair_sdk<= 21.0.0.198
adobeair_sdk_compiler<= 21.0.0.198
adobeflash_player<= 21.0.0.241
adobeflash_player<= 18.0.0.343
adobeflash_player<= 11.2.202.616
adobeflash_player<= 21.0.0.216
adobeflash_player<= 21.0.0.213
adobeflash_player_desktop_runtime<= 21.0.0.226
microsoftinternet_explorer
microsoftinternet_explorer

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://127.0.0.1/LoadMP42.swf?file=t.mp4
filenameLoadMP42.swf
  • A specially crafted .MP4 file delivered via a .SWF loader triggers stack corruption in Adobe Flash Player; monitor for SWF files loading external MP4 resources via query-string parameters.
  • Exploitation targets Adobe Flash Player 21.0.0.213 and earlier, including the Flash libraries embedded in Microsoft Internet Explorer 10/11 and Microsoft Edge; alert on these specific Flash versions in use.
  • The exploit PoC is distributed as a ZIP archive (39828.zip) containing the malicious SWF/MP4 payload; detections should cover this archive and its contents.
  • ·The vulnerability is described as 'unspecified' with unknown attack vectors; no concrete technical details about the memory corruption mechanism are publicly disclosed.
  • ·CVE-2016-1096 is one of multiple memory corruption CVEs fixed in the same Adobe Flash update (APSB16-15); detections should account for the broader vulnerability class across all listed CVEs.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
osv7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.