CVE-2016-7864
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable...
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2016-7864- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2016-7864- Updated
- 2026-11-02
EUVDEUVD-2016-8713 No score
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
EUVD-2016-8713- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3vxq-cppx-jr4w
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable...
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
GHSA-3vxq-cppx-jr4w- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2016:2676
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2016:2676- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-7864
Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
UBUNTU-CVE-2016-7864- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0370 No score
Updated flash-player-plugin packages fix security vulnerabilities
Adobe Flash Player 11.2.202.644 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves type confusion vulnerabilities that could lead to code execution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).
- Record
MGASA-2016-0370- Updated
- 2026-11-02
OSVSUSE-SU-2016:2778-1 No score
Security update for flash-player
This update to Adobe Flash Player 11.2.202.644 fixes the following security issues:
- type confusion vulnerabilities that could lead to code execution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865)
- use-after-free vulnerabilities that could lead to code execution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864)
- Record
SUSE-SU-2016:2778-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 9 CVEs |
before 11.2.202.644-1.mga5.nonfree | 11.2.202.644-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 9 CVEs |
before 0:11.2.202.644-1.el5_11 | 0:11.2.202.644-1.el5_11 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 9 CVEs |
before 0:11.2.202.644-1.el5_11 | 0:11.2.202.644-1.el5_11 |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 9 CVEs |
before 0:11.2.202.644-1.el6_8 | 0:11.2.202.644-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 9 CVEs |
before 11.2.202.644-149.1 | 11.2.202.644-149.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 9 CVEs |
before 11.2.202.644-149.1 | 11.2.202.644-149.1 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 11.2.202.644ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 42 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.1 |
11.2.202.644ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 11.2.202.644ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 8 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.1 |
11.2.202.644ubuntu0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-7864 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published November 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.04%, the 94th percentile. Fixed in flashplugin-nonfree 11.2.202.644ubuntu0.14.04.1.
References
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-141
helpx.adobe.com/security/products/flash-player/apsb16-37.html
securityfocus.com/bid/94153
zerodayinitiative.com/advisories/ZDI-16-597
rhn.redhat.com/errata/RHSA-2016-2676.html
securitytracker.com/id/1037240
Show 47 moreShow less
security.gentoo.org/glsa/201611-18
nvd.nist.gov/vuln/detail/CVE-2016-7864
github.com/advisories/GHSA-3vxq-cppx-jr4w
advisories.mageia.org/MGASA-2016-0370.html
bugs.mageia.org/show_bug.cgi?id=19741
access.redhat.com/errata/RHSA-2016:2676
bugzilla.redhat.com/show_bug.cgi?id=1393087
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2676.json
cve.org/CVERecord?id=CVE-2016-7857
suse.com/support/update/announcement/2016/suse-su-20162778-1
bugzilla.suse.com/1009217
ubuntu.com/security/CVE-2016-7864