CVE-2019-7096
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and...
CVE-2019-7096 is a critical vulnerability (CVSS 9.8) in Adobe Flash Player, published April 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.18%, the 93rd percentile. Fixed in flash-player-plugin 32.0.0.171-1.mga6.nonfree.
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2019-7096- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
CVE-2019-7096- Updated
- 2026-11-02
EUVDEUVD-2019-16647 No score
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
EUVD-2019-16647- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9p2m-7x3f-fh47
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and...
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
GHSA-9p2m-7x3f-fh47- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2019:0737
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2019:0737- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7096
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- Record
UBUNTU-CVE-2019-7096- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0149 No score
Updated flash-player-plugin packages fix security vulnerability
An out-of-bounds read that leads to information disclosure. (CVE-2019-7108)
A use after free that leads to arbitrary code execution. (CVE-2019-7096)
- Record
MGASA-2019-0149- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 |
before 32.0.0.171-1.mga6.nonfree | 32.0.0.171-1.mga6.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:32.0.0.171-1.el6_10 | 0:32.0.0.171-1.el6_10 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 32.0.0.171ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1 |
32.0.0.171ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 32.0.0.171ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 41 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.129.0.0.171ubuntu0.16.04.130.0.0.113ubuntu0.16.04.130.0.0.134ubuntu0.16.04.130.0.0.154ubuntu0.16.04.131.0.0.108ubuntu0.16.04.131.0.0.122ubuntu0.16.04.131.0.0.148ubuntu0.16.04.131.0.0.153ubuntu0.16.04.132.0.0.101ubuntu0.16.04.132.0.0.114ubuntu0.16.04.132.0.0.142ubuntu0.16.04.132.0.0.156ubuntu0.16.04.1 |
32.0.0.171ubuntu0.16.04.1 |
flashplugin-nonfreeUbuntu:18.04:LTS |
before 32.0.0.171ubuntu0.18.04.1, plus listed versions 27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1 Show 16 moreShow less28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu129.0.0.171ubuntu130.0.0.113ubuntu0.18.04.130.0.0.134ubuntu0.18.04.130.0.0.154ubuntu0.18.04.131.0.0.108ubuntu0.18.04.131.0.0.122ubuntu0.18.04.131.0.0.148ubuntu0.18.04.131.0.0.153ubuntu0.18.04.132.0.0.101ubuntu0.18.04.132.0.0.114ubuntu0.18.04.132.0.0.142ubuntu0.18.04.132.0.0.156ubuntu0.18.04.1 |
32.0.0.171ubuntu0.18.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
helpx.adobe.com/security/products/flash-player/apsb19-19.html
security.gentoo.org/glsa/201908-21
nvd.nist.gov/vuln/detail/CVE-2019-7096
github.com/advisories/GHSA-9p2m-7x3f-fh47
advisories.mageia.org/MGASA-2019-0149.html
bugs.mageia.org/show_bug.cgi?id=24643
Show 12 moreShow less
access.redhat.com/errata/RHSA-2019:0737
bugzilla.redhat.com/show_bug.cgi?id=1698202
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0737.json
cve.org/CVERecord?id=CVE-2019-7096
ubuntu.com/security/CVE-2019-7096
rhn.redhat.com/errata/RHSA-2019-0737.html
Left out here: 30 versions. The JSON record has them.