HIGH KEV
flash-plugin: use-after-free issue fixed in APSB16-36
Published Nov 1, 2016 ·Due Mar 24, 2022
8.8
HIGHCVSS 3.1
EPSS 25.20%
Description
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
Affected products
No data.
Configuration 1
AND
- ≤ 23.0.0.185
Configuration 2
AND
OR
- ≤ 23.0.0.185
- ≤ 23.0.0.185
Running on/with
OR
- n/a
- 1511
- 1607
- n/a
- n/a
- n/a
- r2
Configuration 3
AND
- ≤ 11.2.202.637
Running on/with
- n/a
Configuration 4
Configuration 5
OR
- 5.0
- 6.0
- 5.0
- 6.0
- 5.0
- 6.0
No data.
Red Hat Enterprise Linux 5 Supplementary
flash-plugin-0:11.2.202.643-1.el5_11
Fixed · RHSA-2016:2119
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:11.2.202.643-1.el6_8
Fixed · RHSA-2016:2119
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 Supplementary | flash-plugin-0:11.2.202.643-1.el5_11 | Fixed | RHSA-2016:2119 |
| Red Hat Enterprise Linux 6 Supplementary | flash-plugin-0:11.2.202.643-1.el6_8 | Fixed | RHSA-2016:2119 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
8.8 HIGH NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
8.8 HIGH Red Hat
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
9.3 HIGH NVD
AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
Listed in CISA KEV KEV
Date Added
Mar 3, 2022
Patch Due
Mar 24, 2022
Required Action
The impacted product is end-of-life and should be disconnected if still in use.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Feb 4, 2025 · SSVC 2.0.3
25.20% 0.25198
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.25198
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (65 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 25.20% (0.25198) | 97.88th | v5 (v2026.06.15) |
| Jun 15, 2026 | 25.20% (0.25198) | 97.65th | v5 (v2026.06.15) |
| May 20, 2026 | 58.97% (0.58965) | 98.25th | v4 (v2025.03.14) |
| May 13, 2026 | 61.61% (0.61610) | 98.35th | v4 (v2025.03.14) |
| Apr 22, 2026 | 57.49% (0.57486) | 98.17th | v4 (v2025.03.14) |
| Apr 4, 2026 | 49.76% (0.49760) | 97.79th | v4 (v2025.03.14) |
| Mar 4, 2026 | 46.89% (0.46889) | 97.60th | v4 (v2025.03.14) |
| Mar 1, 2026 | 43.16% (0.43163) | 97.44th | v4 (v2025.03.14) |
| Feb 4, 2026 | 46.89% (0.46889) | 97.58th | v4 (v2025.03.14) |
| Feb 1, 2026 | 43.16% (0.43163) | 97.42th | v4 (v2025.03.14) |
| Jan 4, 2026 | 46.89% (0.46889) | 97.56th | v4 (v2025.03.14) |
| Jan 1, 2026 | 43.16% (0.43163) | 97.39th | v4 (v2025.03.14) |
| Dec 4, 2025 | 46.89% (0.46889) | 97.52th | v4 (v2025.03.14) |
| Dec 1, 2025 | 43.16% (0.43163) | 97.36th | v4 (v2025.03.14) |
| Nov 4, 2025 | 46.89% (0.46889) | 97.53th | v4 (v2025.03.14) |
| Nov 1, 2025 | 43.16% (0.43163) | 97.36th | v4 (v2025.03.14) |
| Oct 4, 2025 | 46.89% (0.46889) | 97.58th | v4 (v2025.03.14) |
| Oct 1, 2025 | 43.16% (0.43163) | 97.42th | v4 (v2025.03.14) |
| Sep 4, 2025 | 46.89% (0.46889) | 97.60th | v4 (v2025.03.14) |
| Sep 1, 2025 | 43.16% (0.43163) | 97.43th | v4 (v2025.03.14) |
| Aug 5, 2025 | 46.89% (0.46889) | 97.57th | v4 (v2025.03.14) |
| Aug 1, 2025 | 43.16% (0.43163) | 97.41th | v4 (v2025.03.14) |
| Jul 21, 2025 | 46.89% (0.46889) | 97.54th | v4 (v2025.03.14) |
| Jul 9, 2025 | 42.31% (0.42310) | 97.30th | v4 (v2025.03.14) |
| Jul 5, 2025 | 45.47% (0.45473) | 97.46th | v4 (v2025.03.14) |
| Jul 4, 2025 | 38.93% (0.38931) | 97.09th | v4 (v2025.03.14) |
| Jul 1, 2025 | 36.55% (0.36550) | 96.96th | v4 (v2025.03.14) |
| Jun 4, 2025 | 38.93% (0.38931) | 97.07th | v4 (v2025.03.14) |
| Jun 1, 2025 | 36.55% (0.36550) | 96.94th | v4 (v2025.03.14) |
| May 5, 2025 | 38.93% (0.38931) | 97.05th | v4 (v2025.03.14) |
| May 1, 2025 | 36.55% (0.36550) | 96.90th | v4 (v2025.03.14) |
| Apr 20, 2025 | 38.93% (0.38931) | 97.04th | v4 (v2025.03.14) |
| Apr 19, 2025 | 36.55% (0.36550) | 96.86th | v4 (v2025.03.14) |
| Apr 16, 2025 | 38.93% (0.38931) | 97.03th | v4 (v2025.03.14) |
| Apr 15, 2025 | 36.55% (0.36550) | 96.86th | v4 (v2025.03.14) |
| Apr 14, 2025 | 38.93% (0.38931) | 97.00th | v4 (v2025.03.14) |
| Apr 13, 2025 | 36.55% (0.36550) | 96.83th | v4 (v2025.03.14) |
| Apr 2, 2025 | 38.93% (0.38931) | 96.98th | v4 (v2025.03.14) |
| Apr 1, 2025 | 36.55% (0.36550) | 96.80th | v4 (v2025.03.14) |
| Mar 30, 2025 | 38.93% (0.38931) | 96.97th | v4 (v2025.03.14) |
| Mar 29, 2025 | 82.56% (0.82558) | 99.03th | v4 (v2025.03.14) |
| Mar 28, 2025 | 38.93% (0.38931) | 96.97th | v4 (v2025.03.14) |
| Mar 27, 2025 | 82.56% (0.82558) | 99.16th | v4 (v2025.03.14) |
| Mar 22, 2025 | 69.15% (0.69150) | 98.57th | v4 (v2025.03.14) |
| Mar 20, 2025 | 61.92% (0.61921) | 98.22th | v4 (v2025.03.14) |
| Mar 19, 2025 | 84.07% (0.84074) | 99.26th | v4 (v2025.03.14) |
| Mar 17, 2025 | 69.15% (0.69150) | 98.53th | v4 (v2025.03.14) |
| Dec 30, 2024 | 27.13% (0.27135) | 96.79th | v3 (v2023.03.01) |
| Dec 17, 2024 | 45.02% (0.45023) | 97.46th | v3 (v2023.03.01) |
| Dec 12, 2024 | 11.87% (0.11870) | 95.56th | v3 (v2023.03.01) |
| Oct 27, 2024 | 11.64% (0.11637) | 95.42th | v3 (v2023.03.01) |
| Aug 24, 2024 | 14.02% (0.14019) | 95.77th | v3 (v2023.03.01) |
| Jul 22, 2024 | 9.73% (0.09733) | 94.86th | v3 (v2023.03.01) |
| Jun 19, 2024 | 11.07% (0.11069) | 95.18th | v3 (v2023.03.01) |
| May 16, 2024 | 10.30% (0.10302) | 94.94th | v3 (v2023.03.01) |
| Apr 13, 2024 | 11.29% (0.11295) | 95.10th | v3 (v2023.03.01) |
| Mar 10, 2024 | 10.27% (0.10267) | 94.80th | v3 (v2023.03.01) |
| Oct 10, 2023 | 8.67% (0.08675) | 93.78th | v3 (v2023.03.01) |
| Oct 9, 2023 | 12.38% (0.12378) | 94.76th | v3 (v2023.03.01) |
| Jul 15, 2023 | 8.67% (0.08675) | 93.65th | v3 (v2023.03.01) |
| Mar 7, 2023 | 6.23% (0.06228) | 92.42th | v3 (v2023.03.01) |
| Mar 6, 2023 | 6.68% (0.06681) | 91.55th | v2 (v2022.01.01) |
| Sep 12, 2022 | 6.68% (0.06681) | 91.18th | v2 (v2022.01.01) |
| Apr 1, 2022 | 5.94% (0.05941) | 89.63th | v2 (v2022.01.01) |
| Feb 4, 2022 | 5.94% (0.05941) | 77.48th | v2 (v2022.01.01) |
Weaknesses (1)
References (13)
- http://rhn.redhat.com/errata/RHSA-2016-2119.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.securityfocus.com/bid/93861 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037111 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2016-7855 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1389033 Issue Tracking
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-128 vendor-advisoryx_refsource_MSPatchVendor Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb16-36.html x_refsource_CONFIRMPatchVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-7855
- https://security.gentoo.org/glsa/201610-10 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html x_refsource_MISCThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7855 government-resourceUS Government Resource
- https://www.cve.org/CVERecord?id=CVE-2016-7855
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner adobe
Published Nov 1, 2016
Updated Oct 21, 2025
Reserved Sep 9, 2016
Link CVE-2016-7855
CISA Vulnrichment
Updated Feb 4, 2025