Every CVE Search/ Get API key

CVE-2016-4287

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162...

8.8 HighFix available

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

7.25%Up 4.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Record
CVE-2016-4287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Record
CVE-2016-4287
Updated
2026-11-02
EUVDEUVD-2016-5287 No score

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Record
EUVD-2016-5287
Updated
2026-11-03
GitHub AdvisoriesGHSA-v3x4-9vpx-6mp3 9.8

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162...

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Record
GHSA-v3x4-9vpx-6mp3
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVRHSA-2016:1865 8.8

Red Hat Security Advisory: flash-plugin security update

Record
RHSA-2016:1865
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0315 No score

Updated flash-player-plugin packages fix security vulnerability

Adobe Flash Player 11.2.202.635 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.

This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2016-4287).

This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932).

This update resolves security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278).

This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924).

Record
MGASA-2016-0315
Updated
2026-11-02
OSVSUSE-SU-2016:2312-1 No score

Security update for flash-player

This update for flash-player fixes the following security issues (APSB16-29, boo#998589):

  • integer overflow vulnerability that could lead to code execution (CVE-2016-4287).
  • use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932)
  • security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278)
  • memory corruption vulnerabilities that could lead to code execution (CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924)
Record
SUSE-SU-2016:2312-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-player-plugin
Mageia:5
 before 11.2.202.635-1.mga5.nonfree
11.2.202.635-1.mga5.nonfree
flash-plugin
Red Hat:rhel_extras:5::client
 before 0:11.2.202.635-1.el5_11
0:11.2.202.635-1.el5_11
flash-plugin
Red Hat:rhel_extras:5::server
 before 0:11.2.202.635-1.el5_11
0:11.2.202.635-1.el5_11
flash-plugin
Red Hat:rhel_extras:6
 before 0:11.2.202.635-1.el6_8
0:11.2.202.635-1.el6_8
flash-player
SUSE:Linux Enterprise Desktop 12 SP1
 before 11.2.202.635-140.1
11.2.202.635-140.1
flash-player
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 11.2.202.635-140.1
11.2.202.635-140.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4287 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published September 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.25%, the 94th percentile. Fixed in flash-player-plugin 11.2.202.635-1.mga5.nonfree.

References

Show 114 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open