CVE-2016-6992

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X...

8.8 HighFix available

CVE-2016-6992 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published October 12, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.25%, the 93rd percentile. Fixed in flash-player-plugin 11.2.202.637-1.mga5.nonfree.

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.25%Up 3.1 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2016-6992
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-843
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-6992
Updated: 2026-11-02

EUVDEUVD-2016-7877 No score

Record: EUVD-2016-7877
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5c4v-w575-7m4r 9.8

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X...

Record: GHSA-5c4v-w575-7m4r
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-704, CWE-843
Updated: 2026-11-02

OSVRHSA-2016:2057 8.8

Red Hat Security Advisory: flash-plugin security update

Record: RHSA-2016:2057
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-6992 8.8

Record: UBUNTU-CVE-2016-6992
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0346 No score

Updated flash-player-plugin package fixes security vulnerabilities

Adobe Flash Player 11.2.202.637 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.

This update resolves a type confusion vulnerability that could lead to code execution (CVE-2016-6992). This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-6981, CVE-2016-6987). This update resolves a security bypass vulnerability (CVE-2016-4286). This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, CVE-2016-6990).

Record: MGASA-2016-0346
Updated: 2026-11-02

OSVSUSE-SU-2016:2512-1 No score

Security update for flash-playerqemu

flash-player was updated to version 11.2.202.637 to fix the following issues (bsc#1004019):

CVE-2016-6992: A type confusion vulnerability that could lead to code execution. CVE-2016-6981, CVE-2016-6987: use-after-free vulnerabilities that could lead to code execution CVE-2016-4286: Security bypass vulnerability CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, CVE-2016-6990: Memory corruption vulnerabilities that could lead to code execution

Also the EULA was updated to version 23.0 (bsc#1003993).

Record: SUSE-SU-2016:2512-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:5	before 11.2.202.637-1.mga5.nonfree	11.2.202.637-1.mga5.nonfree
`flash-plugin` Red Hat:rhel_extras:5::client	before 0:11.2.202.637-1.el5_11	0:11.2.202.637-1.el5_11
`flash-plugin` Red Hat:rhel_extras:5::server	before 0:11.2.202.637-1.el5_11	0:11.2.202.637-1.el5_11
`flash-plugin` Red Hat:rhel_extras:6	before 0:11.2.202.637-1.el6_8	0:11.2.202.637-1.el6_8
`flash-player` SUSE:Linux Enterprise Desktop 12 SP1	before 11.2.202.637-143.1	11.2.202.637-143.1
`flash-player` SUSE:Linux Enterprise Workstation Extension 12 SP1	before 11.2.202.637-143.1	11.2.202.637-143.1
`flashplugin-nonfree` Ubuntu:14.04:LTS	before 11.2.202.637ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 40 moreShow less 11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.1	11.2.202.637ubuntu0.14.04.1
`flashplugin-nonfree` Ubuntu:16.04:LTS	before 11.2.202.637ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 6 moreShow less 11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.1	11.2.202.637ubuntu0.16.04.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 58 moreShow less