CVE-2016-7855
Published 2016-11-01 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2016-7855 is a high-severity (CVSS 8.8) vulnerability in Adobe Flash Player. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 24, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Flash Player
Name: Adobe Flash Player Use-After-Free Vulnerability
Date added: 2022-03-03 · Due: 2022-03-24
Required action: The impacted product is end-of-life and should be disconnected if still in use.
References
- http://rhn.redhat.com/errata/RHSA-2016-2119.html
- http://www.securityfocus.com/bid/93861
- http://www.securitytracker.com/id/1037111
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-128
- https://helpx.adobe.com/security/products/flash-player/apsb16-36.html
- https://security.gentoo.org/glsa/201610-10
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html
- http://rhn.redhat.com/errata/RHSA-2016-2119.html