CVE-2016-4122
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe...
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
CVE-2016-4122- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
CVE-2016-4122- Updated
- 2026-11-02
EUVDEUVD-2016-5123 No score
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
EUVD-2016-5123- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p239-7q2p-cw3v
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe...
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
- Record
GHSA-p239-7q2p-cw3v- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVMGASA-2016-0228 No score
Updated flash-player-plugin packages fix security vulnerabilities
Adobe Flash Player 11.2.202.626 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves type confusion vulnerabilities that could lead to code execution (CVE-2016-4144, CVE-2016-4149).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).
This update resolves heap buffer overflow vulnerabilities that could lead to code execution (CVE-2016-4135, CVE-2016-4136, CVE-2016-4138).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).
This update resolves a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4140).
This update resolves a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2016-4139).
Adobe reports that an exploit for CVE-2016-4171 exists in the wild.
- Record
MGASA-2016-0228- Updated
- 2026-11-02
OSVSUSE-SU-2016:1613-1 No score
Security update for flash-player
Adobe flash-player was updated to 11.2.202.626 to fix the following security issues:
Security update to 11.2.202.626 (boo#984695):
- APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171
Please see https://helpx.adobe.com/security/products/flash-player/apsb16-18.html for more information.
- Record
SUSE-SU-2016:1613-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 36 CVEs |
before 11.2.202.626-1.1.mga5.nonfree | 11.2.202.626-1.1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el5_11 | 0:11.2.202.626-1.el5_11 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el5_11 | 0:11.2.202.626-1.el5_11 |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 36 CVEs |
before 0:11.2.202.626-1.el6_8 | 0:11.2.202.626-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 36 CVEs |
before 11.2.202.626-133.1 | 11.2.202.626-133.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4122 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published June 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.81%, the 90th percentile. No source names a fixed version.
References
securitytracker.com/id/1036117
docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-083
lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html
access.redhat.com/errata/RHSA-2016:1238
Show 155 moreShow less
helpx.adobe.com/security/products/flash-player/apsb16-18.html
nvd.nist.gov/vuln/detail/CVE-2016-4122
github.com/advisories/GHSA-p239-7q2p-cw3v
advisories.mageia.org/MGASA-2016-0228.html
bugs.mageia.org/show_bug.cgi?id=18720
bugzilla.redhat.com/show_bug.cgi?id=1346665
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1238.json
cve.org/CVERecord?id=CVE-2016-4122
cisa.gov/known-exploited-vulnerabilities-catalog
suse.com/support/update/announcement/2016/suse-su-20161613-1
bugzilla.suse.com/984695