cbcvebase.
CVE-2016-4275
published 2016-09-14

CVE-2016-4275: Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute…

PriorityP267high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
19.44%
97.1th percentile
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobeflash_player<= 11.2.202.632—
adobeflash_player<= 22.0.0.211—
adobeflash_player<= 18.0.0.366—
adobeflash_player_desktop_runtime<= 22.0.0.211—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40421.zip↗
  • →Crash occurs in Adobe Flash AVC decoder memory-free path, indicating memory corruption; monitor Flash Player process crashes originating from AVC decoding routines ↗
  • →Vulnerability is fixed in the September (2016) Flash update; flag any Flash Player versions before 23.0.0.162 (Windows/OS X) or before 11.2.202.635 (Linux) as unpatched and at risk ↗
  • ·The NVD source URL references CVE-2016-4280, not CVE-2016-4275 directly; CVE-2016-4275 is listed as one of several sibling memory-corruption CVEs sharing the same affected version ranges and fix ↗
  • ·The exploit-db PoC (40421.zip) is the only concrete artifact available; no hash or further payload details are provided in the sources ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.