{"id":"CVE-2016-0984","published":"2016-02-10T20:59:32Z","modified":"2026-06-17T00:38:36Z","title":"Adobe Flash Player and AIR Use-After-Free Vulnerability","vendor":"Adobe","product":"Flash Player and AIR","tier":"core","eol":null,"description":{"text":"Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability is a use-after-free flaw in Adobe Flash Player and Adobe AIR (including the AIR SDK and SDK & Compiler), affecting the Flash Player and AIR component handling of freed memory. An attacker can execute arbitrary code by exploiting this flaw via unspecified vectors over the network, and the attack requires user interaction (UI:R) but no privileges or authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:26Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.54544,"percentile":0.99013,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","ransomware":false,"requiredAction":"The impacted products are end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0984","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-01-11","exploitedFirstSeen":"2016-01-11","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-01-11"},{"url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/","date":"2017-10-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-25"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00025.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00027.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00029.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00030.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0166.html","tags":["Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1034970","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-04.html","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-07","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/39462/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00025.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00027.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00029.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00030.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0166.html","tags":["Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1034970","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-04.html","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-07","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/39462/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0984","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.\n\nThis CVE was observed to be exploited by the threat actor known as BlackOasis.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"primary_impact","evidence":[],"comment":"This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.\n\nThis CVE was observed to be exploited by the threat actor known as BlackOasis. The threat actor then installs command and control tools.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-0994","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0994","exploited":true,"exploitedSince":"2022-05-25","provenance":"source"},"exploits":[{"id":39462,"url":"https://www.exploit-db.com/exploits/39462","title":"Adobe Flash - Sound.loadPCMFromByteArray Dangling Pointer","type":"dos","platform":"multiple","date":"2016-02-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-02-17"},"first":{"date":"2016-02-17","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39462"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/39462/"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2016-01-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2016-02-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0984","provenance":"source"},{"date":"2016-02-17","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-39462)","url":"https://www.exploit-db.com/exploits/39462","provenance":"source"},{"date":"2022-05-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0994","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"Exploit-DB","daysToKev":2296},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3944 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9901"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}