CVE-2016-4275
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
CVE-2016-4275- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
CVE-2016-4275- Updated
- 2026-11-02
EUVDEUVD-2016-5275 No score
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
EUVD-2016-5275- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x83x-pfj2-3j2c
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
- Record
GHSA-x83x-pfj2-3j2c- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
OSVRHSA-2016:1865
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2016:1865- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0315 No score
Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 11.2.202.635 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2016-4287).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932).
This update resolves security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924).
- Record
MGASA-2016-0315- Updated
- 2026-11-02
OSVSUSE-SU-2016:2312-1 No score
Security update for flash-player
This update for flash-player fixes the following security issues (APSB16-29, boo#998589):
- integer overflow vulnerability that could lead to code execution (CVE-2016-4287).
- use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932)
- security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278)
- memory corruption vulnerabilities that could lead to code execution (CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924)
- Record
SUSE-SU-2016:2312-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 26 CVEs |
before 11.2.202.635-1.mga5.nonfree | 11.2.202.635-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 26 CVEs |
before 0:11.2.202.635-1.el5_11 | 0:11.2.202.635-1.el5_11 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 26 CVEs |
before 0:11.2.202.635-1.el5_11 | 0:11.2.202.635-1.el5_11 |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 26 CVEs |
before 0:11.2.202.635-1.el6_8 | 0:11.2.202.635-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 29 CVEs |
before 11.2.202.635-140.1 | 11.2.202.635-140.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 29 CVEs |
before 11.2.202.635-140.1 | 11.2.202.635-140.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe Flash - Crash When Freeing Memory After AVC decoding | 2016-09-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4275 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published September 14, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.4%, the 97th percentile. No source names a fixed version.
References
security.gentoo.org/glsa/201610-10
helpx.adobe.com/security/products/flash-player/apsb16-29.html
rhn.redhat.com/errata/RHSA-2016-1865.html
securityfocus.com/bid/92930
exploit-db.com/exploits/40421
securitytracker.com/id/1036791
Show 116 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-4275
github.com/advisories/GHSA-x83x-pfj2-3j2c
advisories.mageia.org/MGASA-2016-0315.html
bugs.mageia.org/show_bug.cgi?id=19359
access.redhat.com/errata/RHSA-2016:1865
bugzilla.redhat.com/show_bug.cgi?id=1375725
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1865.json
cve.org/CVERecord?id=CVE-2016-4271
suse.com/support/update/announcement/2016/suse-su-20162312-1
bugzilla.suse.com/998589