CVE-2016-4227: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on…

PriorityP271high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

32.89%

98.2th percentile

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
adobe	flash_player	<= 18.0.0.360	—
adobe	flash_player	<= 22.0.0.192	—
adobe	flash_player	<= 11.2.202.626	—
adobe	flash_player_desktop_runtime	<= 22.0.0.192	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40307.zip↗

→CVE-2016-4227 is triggered via Selection.setFocus called as a method on a MovieClip object (mc.f = Selection.setFocus; mc.f({toString: func})), causing a use-after-free when the toString callback removes the clip mid-execution. Detect SWF files invoking Selection.setFocus with a non-string object argument whose toString property is a function. ↗
→PoC pattern: a MovieClip is created, Selection.setFocus is assigned as a method on it, then called with an object whose toString triggers removeMovieClip on the same clip. Monitor for SWF ActionScript patterns matching createEmptyMovieClip followed by Selection.setFocus reassignment and removeMovieClip inside a toString callback. ↗
→Crash is observed in Chrome on 64-bit Linux; prioritize monitoring of Chrome/Flash plugin process crashes on Linux 64-bit as an indicator of exploitation attempts. ↗

·The NVD source (DOC 1) is for CVE-2016-4229, not CVE-2016-4227; CVE-2016-4227 is only mentioned incidentally as a related but distinct use-after-free vulnerability. No separate technical detail for CVE-2016-4227 is provided in that document. ↗
·The Exploit-DB entry (40307) references bugs.chromium.org project-zero issue #841 as the original source; the exploit ZIP contains a sample SWF and FLA which are the actual weaponized artifacts. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C

osv8.8HIGH

vendor_redhat8.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.