CVE-2016-1105

published 2016-05-11

CVE-2016-1105: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and…

Priority P2 62 high 7.5 CVSS 3.0

AV N AC H PR N UI R S U C H I H A H

EXPLOIT

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
adobe	flash_player	<= 21.0.0.213	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

command _global.ASnative(2204, 200)(this)↗

• → Type confusion triggered via watch() callback on FileReference constructor property 'name' — monitor ActionScript watch() calls on FileReference objects combined with prototype chain manipulation (__proto__ reassignment) as an exploitation pattern. ↗
• → Exploit abuses ASnative(2204, 200) to invoke the FileReference constructor directly — detection of ASnative calls with opcode 2204/200 in SWF bytecode is a strong indicator of exploitation. ↗
• → Prototype chain hijacking to flash.display.BitmapData constructor is used to set up type confusion — look for __proto__.__constructor__ being set to flash.display.BitmapData within a watch callback. ↗

• · The vulnerability affects Adobe Flash Player 21.0.0.213 and earlier; the exact attack vector is officially listed as unspecified by Adobe/NVD. ↗
• · The type confusion occurs because the FileReference constructor sets properties before finalizing object type/data — a watch on those properties allows attacker code to run mid-construction, meaning exploitation is GC-triggered and timing-dependent. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 7.6 HIGH AV:N/AC:H/Au:N/C:C/I:C/A:C

vendor_redhat 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.