CVE-2016-0984
Adobe Flash Player and AIR Use-After-Free Vulnerability
Description
CVE-2016-0984 is a use-after-free vulnerability in Adobe Flash Player and Adobe AIR that allows attackers to execute arbitrary code on the affected system. The vulnerability occurs when Flash Player references memory that has already been freed, enabling an attacker to manipulate the freed memory region and redirect program execution to malicious code. This Adobe Flash Player security flaw can be exploited remotely through crafted Flash content embedded in web pages. CISA has listed CVE-2016-0984 in the Known Exploited Vulnerabilities catalog, confirming active exploitation, and its EPSS percentile of 98.9% indicates near-certain exploitation activity. The impacted products are end-of-life and should be removed if still in use.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | <= 20.0.0.272; <= 11.2.202.559; <= 18.0.0.326; <= 20.0.0.286 |
| adobe | flash player desktop runtime | <= 20.0.0.286 |
| adobe | air desktop runtime | <= 20.0.0.233 |
| adobe | air sdk | <= 20.0.0.233 |
| adobe | air sdk \& compiler | <= 20.0.0.233 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00025.html(Broken Link, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00027.html(Broken Link, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00029.html(Broken Link, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00030.html(Broken Link, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2016-0166.html(Third Party Advisory)
- http://www.securitytracker.com/id/1034970(Broken Link, Third Party Advisory, VDB Entry)
- https://helpx.adobe.com/security/products/flash-player/apsb16-04.html(Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/201603-07(Third Party Advisory)
- https://www.exploit-db.com/exploits/39462/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0984(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2016-0984 in the NVD database. The vulnerability is a use-after-free condition in Adobe Flash Player and Adobe AIR. Use-after-free occurs when a program continues to reference a memory location after it has been freed (deallocated). An attacker can arrange for the freed memory to be reallocated with controlled data, so when the program subsequently accesses the stale pointer, it operates on attacker-controlled content, leading to arbitrary code execution.
Learn more: CWE Overview
Impact Analysis
CVE-2016-0984 enables remote code execution through a use-after-free condition in Adobe Flash Player and AIR. The vulnerability is remotely exploitable through malicious Flash content without requiring authentication, and only requires that a user views the crafted content in a browser with Flash enabled. Confidentiality (High): Successful exploitation grants the attacker access to all data accessible by the browser process, including session tokens, credentials, and local files. Integrity (High): Arbitrary code execution allows the attacker to install persistent malware, modify system settings, and establish command-and-control channels. Availability (High): Compromised systems can be recruited into botnets, used for distributed attacks, or rendered inoperable. With an EPSS percentile of 98.9%, this vulnerability has a near-certain probability of active exploitation, making immediate removal of Flash Player the only viable remediation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2016-0984 by listing it in the Known Exploited Vulnerabilities catalog. The required action states that the impacted products are end-of-life and should be disconnected if still in use, with a remediation deadline of June 15, 2022. The EPSS percentile of 98.9% places this vulnerability among the most actively exploited, indicating near-certain exploitation activity. Use-after-free vulnerabilities in Flash Player have been among the most commonly exploited vulnerability classes in web-based attacks, frequently incorporated into exploit kits for mass-scale drive-by download campaigns targeting unpatched browsers.
Remediation
- Remove Adobe Flash Player and Adobe AIR completely from all systems. As stated in the CISA KEV required action, the impacted products are end-of-life and should be disconnected if still in use. Adobe ended Flash Player support on December 31, 2020.
- Remove Flash Player browser plugins from all browsers across the organization. Verify removal using browser plugin enumeration and endpoint management tools.
- Migrate Flash-dependent applications to modern web technologies such as HTML5, WebAssembly, and JavaScript. Identify all internal and external applications that rely on Flash Player for functionality.
- Block Flash content at network boundaries using web proxies and content filtering solutions to prevent SWF file downloads, even on systems where Flash has not yet been removed.
- Conduct an enterprise-wide audit for remaining Flash Player and AIR installations using endpoint detection tools and software inventory systems to ensure complete removal.
Technical Details
CVE-2016-0984 is a use-after-free vulnerability in Adobe Flash Player and Adobe AIR. The flaw occurs when the Flash Player runtime frees a memory object but retains a pointer (dangling pointer) that continues to be used by the program. When an attacker crafts Flash content that triggers the specific code path leading to the use-after-free condition, they can arrange for the freed memory to be reallocated with controlled data through heap manipulation techniques. When the Flash runtime subsequently dereferences the stale pointer, it operates on attacker-controlled memory, enabling code execution. Flash Player's ActionScript virtual machine and garbage collector create complex object lifecycle interactions that make use-after-free conditions particularly prevalent and exploitable. The attack is delivered through SWF content processed by the Flash Player browser plugin, requiring no user interaction beyond navigating to or being redirected to a page containing the malicious content.
Frequently Asked Questions
Is CVE-2016-0984 being actively exploited?
Yes, CVE-2016-0984 is actively exploited. CISA confirmed its inclusion in the Known Exploited Vulnerabilities catalog and noted that the impacted products are end-of-life. The EPSS percentile of 98.9% indicates near-certain exploitation activity. No further patches will be released.
What products are affected by CVE-2016-0984?
CVE-2016-0984 affects Adobe Flash Player and Adobe AIR. Both products reached end-of-life on December 31, 2020, and no longer receive security updates. Any remaining installations are permanently vulnerable.
How do I fix CVE-2016-0984?
Completely remove Adobe Flash Player and Adobe AIR from all systems. Since the products are end-of-life, no patches are available. Remove Flash browser plugins, migrate Flash-dependent content to modern web technologies, and block Flash content at network boundaries.
How severe is CVE-2016-0984?
CVE-2016-0984 is a remote code execution vulnerability with an EPSS percentile of 98.9%, indicating near-certain exploitation. The end-of-life status of Flash Player means the vulnerability will never be patched, making complete removal the only effective remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.