CVE-2016-4274
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...
CVE-2016-4274 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published September 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.43%, the 91st percentile. Fixed in flash-player-plugin 11.2.202.635-1.mga5.nonfree.
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
CVE-2016-4274- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
CVE-2016-4274- Updated
- 2026-11-02
EUVDEUVD-2016-5274 No score
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
EUVD-2016-5274- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jqjc-23q2-72qc
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
GHSA-jqjc-23q2-72qc- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
OSVRHSA-2016:1865
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2016:1865- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0315 No score
Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 11.2.202.635 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2016-4287).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932).
This update resolves security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924).
- Record
MGASA-2016-0315- Updated
- 2026-11-02
OSVSUSE-SU-2016:2312-1 No score
Security update for flash-player
This update for flash-player fixes the following security issues (APSB16-29, boo#998589):
- integer overflow vulnerability that could lead to code execution (CVE-2016-4287).
- use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932)
- security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278)
- memory corruption vulnerabilities that could lead to code execution (CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924)
- Record
SUSE-SU-2016:2312-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 |
before 11.2.202.635-1.mga5.nonfree | 11.2.202.635-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client |
before 0:11.2.202.635-1.el5_11 | 0:11.2.202.635-1.el5_11 |
flash-pluginRed Hat:rhel_extras:5::server |
before 0:11.2.202.635-1.el5_11 | 0:11.2.202.635-1.el5_11 |
flash-pluginRed Hat:rhel_extras:6 |
before 0:11.2.202.635-1.el6_8 | 0:11.2.202.635-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 |
before 11.2.202.635-140.1 | 11.2.202.635-140.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 11.2.202.635-140.1 | 11.2.202.635-140.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security.gentoo.org/glsa/201610-10
helpx.adobe.com/security/products/flash-player/apsb16-29.html
rhn.redhat.com/errata/RHSA-2016-1865.html
securityfocus.com/bid/92930
securitytracker.com/id/1036791
nvd.nist.gov/vuln/detail/CVE-2016-4274
Show 115 moreShow less
github.com/advisories/GHSA-jqjc-23q2-72qc
advisories.mageia.org/MGASA-2016-0315.html
bugs.mageia.org/show_bug.cgi?id=19359
access.redhat.com/errata/RHSA-2016:1865
bugzilla.redhat.com/show_bug.cgi?id=1375725
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1865.json
cve.org/CVERecord?id=CVE-2016-4271
suse.com/support/update/announcement/2016/suse-su-20162312-1
bugzilla.suse.com/998589