CVE-2016-4121

critical · 9.8

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, and CVE-2016-4110.

9.8

CVSS

10.0%

EPSS (exploit prob.)

95th

EPSS percentile

2016-06-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
microsoft	windows_10	all versions
microsoft	windows_8.1	all versions
adobe	flash_player	<= 21.0.0.241
adobe	flash_player	<= 21.0.0.241
adobe	flash_player	<= 18.0.0.343
apple	mac_os_x	all versions
microsoft	windows	all versions
adobe	air_sdk_&_compiler	<= 21.0.0.198
apple	iphone_os	all versions
apple	mac_os_x	all versions
google	android	all versions
microsoft	windows	all versions
adobe	air_sdk	<= 21.0.0.198
apple	iphone_os	all versions
apple	mac_os_x	all versions
google	android	all versions
microsoft	windows	all versions
adobe	flash_player	<= 11.2.202.616
linux	linux_kernel	all versions
adobe	flash_player	<= 21.0.0.216
apple	mac_os_x	all versions
google	chrome_os	all versions
linux	linux_kernel	all versions
microsoft	windows	all versions
adobe	flash_player_desktop_runtime	<= 21.0.0.226
apple	mac_os_x	all versions
microsoft	windows	all versions
apple	mac_os_x	all versions
microsoft	windows	all versions
adobe	air_desktop_runtime	<= 21.0.0.198

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-4121