CVE-2016-0959

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-27 · updated 2026-06-17
Weakness: CWE-416

Description

Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.

Affected products

Adobe Air: through 20.0.0.204
Adobe Air Sdk: through 20.0.0.204
Adobe Air Sdk & Compiler: through 20.0.0.204
Adobe Flash Player 24.0.0.186 and earlier.: through 20.0.0.235; through 20.0.0.228
Adobe Flash Player Extended Support Release: through 18.0.0.268
Adobe Flash Player For Linux: through 11.2.202.554

References

Get alerted when CVE-2016-0959 or the next vulnerability affects your stack