CVE-2016-4136
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe...
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
CVE-2016-4136- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
CVE-2016-4136- Updated
- 2026-11-02
EUVDEUVD-2016-5137 No score
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
EUVD-2016-5137- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vgv4-f4q4-76rv
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe...
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
GHSA-vgv4-f4q4-76rv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0228 No score
Updated flash-player-plugin packages fix security vulnerabilities
Adobe Flash Player 11.2.202.626 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves type confusion vulnerabilities that could lead to code execution (CVE-2016-4144, CVE-2016-4149).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).
This update resolves heap buffer overflow vulnerabilities that could lead to code execution (CVE-2016-4135, CVE-2016-4136, CVE-2016-4138).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).
This update resolves a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4140).
This update resolves a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2016-4139).
Adobe reports that an exploit for CVE-2016-4171 exists in the wild.
- Record
MGASA-2016-0228- Updated
- 2026-11-02
OSVSUSE-SU-2016:1613-1 No score
Security update for flash-player
Adobe flash-player was updated to 11.2.202.626 to fix the following security issues:
Security update to 11.2.202.626 (boo#984695):
- APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171
Please see https://helpx.adobe.com/security/products/flash-player/apsb16-18.html for more information.
- Record
SUSE-SU-2016:1613-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 36 CVEs |
before 11.2.202.626-1.1.mga5.nonfree | 11.2.202.626-1.1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el5_11 | 0:11.2.202.626-1.el5_11 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el5_11 | 0:11.2.202.626-1.el5_11 |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el6_8 | 0:11.2.202.626-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe Flash - JXR Processing Double-Free | 2016-07-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4136 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published June 16, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.4%, the 96th percentile. No source names a fixed version.
References
securitytracker.com/id/1036117
exploit-db.com/exploits/40088
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-083
lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html
access.redhat.com/errata/RHSA-2016:1238
Show 156 moreShow less
helpx.adobe.com/security/products/flash-player/apsb16-18.html
nvd.nist.gov/vuln/detail/CVE-2016-4136
github.com/advisories/GHSA-vgv4-f4q4-76rv
advisories.mageia.org/MGASA-2016-0228.html
bugs.mageia.org/show_bug.cgi?id=18720
bugzilla.redhat.com/show_bug.cgi?id=1346665
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1238.json
cve.org/CVERecord?id=CVE-2016-4122
cisa.gov/known-exploited-vulnerabilities-catalog
suse.com/support/update/announcement/2016/suse-su-20161613-1
bugzilla.suse.com/984695