{"id":"CVE-2016-1019","published":"2016-04-07T10:59:01Z","modified":"2026-10-01T20:17:16Z","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":null,"description":{"text":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player contains an unspecified vulnerability in the Flash Player component that allows arbitrary code execution and denial of service. An attacker can exploit it remotely over the network without authentication or user interaction, per the attack vector data, to crash the application or possibly execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:25Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.22316,"percentile":0.97677,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-1019","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-04-02","exploitedFirstSeen":"2016-04-02","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-04-02"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1019","date":"2016-04-07"},{"url":"https://blog.trendmicro.com/trendlabs-security-intelligence/locky-ransomware-spreads-flash-windows-kernel-exploits/","date":"2016-04-28"},{"url":"https://unit42.paloaltonetworks.com/unit42-dealerschoice-sofacys-flash-player-exploit-platform/","date":"2016-10-17"},{"url":"https://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/","date":"2016-12-06"},{"url":"https://us-cert.cisa.gov/ncas/alerts/TA17-164A","date":"2017-06-13"},{"url":"https://cisa.gov/news-events/alerts/2017/06/13/hidden-cobra-north-koreas-ddos-botnet-infrastructure","date":"2017-08-23"},{"url":"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf","date":"2018-02-04"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://cloudsek.com/threatintelligence/north-korean-threat-group-apt38-threat-intel-advisory/","date":"2021-01-27"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://blogs.adobe.com/psirt/?p=1330","tags":["Broken Link","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html","tags":["Broken Link"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0610.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/85856","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035491","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050","tags":["Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa16-01.html","tags":["Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201606-08","tags":["Third Party Advisory"]},{"url":"https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html","tags":["Broken Link"]},{"url":"http://blogs.adobe.com/psirt/?p=1330","tags":["Broken Link","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html","tags":["Broken Link"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0610.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/85856","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035491","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050","tags":["Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa16-01.html","tags":["Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201606-08","tags":["Third Party Advisory"]},{"url":"https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html","tags":["Broken Link"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-3d89b3537203eabaf47a","title":"RATANKBA: Delving into Large-scale Watering Holes","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html","date":"2017-02-27","mentions":[{"quote":"While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.","start":7137,"end":7330}]},{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"CVE-2016-4117, CVE-\r\n2016-1019 and CVE-2015-3043 were all exploited","start":8045,"end":8112},{"quote":"9]\r\nFEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2013-4979\r\nCVE-2013-4979\r\nCVE-2015-5122\r\nCVE-2016-4117\r\nCVE-2014-8439\r\nCVE-2016-1019","start":8842,"end":9161}]},{"id":"SRC-9435b03195e7a0015d5e","title":"34273894723094830293843427389472309483029384","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf","date":null,"mentions":[{"quote":"(CVE-2016-4119, CVE-2016-1019, or CVE-2015-8651) based on the affected","start":69898,"end":69968}]},{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"new Adobe Flash Player exploits in 1H16, including CVE-2016-4117, CVE-\r\n2016-1019, and CVE-2015-8651.","start":100815,"end":100916},{"quote":"CVE-2016-1019 Flash “ASNative” type confusion RCE Adobe Flash APSB16-10 (Apr.","start":119425,"end":119502},{"quote":" CVE-2016-1019 - Flash Player “ASNative” type confusion: This zero-day","start":120953,"end":121024},{"quote":"11 Genwei Jiang, “CVE-2016-1019: A New Flash Exploit Included in Magnitude Exploit Kit,” FireEye Threat","start":122667,"end":122770},{"quote":"Research Blog, April 7, 2016, https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-\r\n1019_a_new.html.","start":122772,"end":122882}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-2123","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-2123","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1486"],"provenance":"source"},{"stage":"related","techniques":["T1189"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-04-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2016-04-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1019","provenance":"source"},{"date":"2017-02-27","kind":"report","label":"Named in trendmicro.com: RATANKBA: Delving into Large-scale Watering Holes","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html","provenance":"machine"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-2123","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2156},"priority":{"score":83.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3862 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.54,"detail":"percentile 0.9768"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}