CVE-2016-7892
Adobe Flash Player Use-After-Free Vulnerability
Description
CVE-2016-7892 is a high-severity use-after-free vulnerability affecting Adobe Flash Player. Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class. An attacker can exploit this flaw without authentication over the network, requiring user interaction. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 23.26% (95.9th percentile) indicates a significantly elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player desktop runtime | <= 23.0.0.207 |
| adobe | flash player | <= 23.0.0.207; <= 11.2.202.644 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html(Broken Link)
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html(Broken Link)
- http://rhn.redhat.com/errata/RHSA-2016-2947.html(Third Party Advisory)
- http://www.securityfocus.com/bid/94877(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037442(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154(Patch, Third Party Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsb16-39.html(Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/201701-17(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed. Once memory is freed, it may be reallocated for other purposes. In the case of CVE-2016-7892, this weakness allows attackers to compromise Adobe Flash Player systems.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2016-7892 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting the serious risk it poses to affected environments. Successful exploitation can lead to complete compromise of data confidentiality, full system integrity compromise, and complete denial of service. The attack vector is network-based with low complexity, meaning exploitation is straightforward and can be reliably repeated. Organizations running Adobe Flash Player face tangible risk of unauthorized access, data breaches, and operational disruption if this vulnerability remains unpatched.
Exploit Maturity
CVE-2016-7892 is listed in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-15, confirming that real-world exploitation has been observed. The EPSS score of 23.26% (95.9th percentile) places this vulnerability among those most likely to be exploited.
Remediation
- The impacted product is end-of-life and should be disconnected if still in use. This is the CISA-mandated remediation action and should be prioritized immediately.
- If the device cannot be immediately decommissioned, isolate it from the network by placing it behind strict firewall rules that block all inbound access from untrusted networks.
- Plan and execute migration to a supported replacement product that receives active security updates.
- Audit network logs and device configurations for indicators of compromise, including unexpected outbound connections, unauthorized configuration changes, or newly created accounts.
- Implement network monitoring to detect any exploitation attempts against the affected Flash Player systems.
Technical Details
CVE-2016-7892 is exploitable remotely over the network without any prior authentication. Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class. The attack complexity is rated low, meaning no specialized conditions or preparation are needed beyond network access to the target. The scope is unchanged, meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score of 8.8 reflects the combination of these factors and the potential for significant damage to affected systems.
Frequently Asked Questions
Is CVE-2016-7892 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2016-7892 to the Known Exploited Vulnerabilities catalog. The EPSS score of 23.26% (95.9th percentile) further indicates high exploitation likelihood.
What products are affected by CVE-2016-7892?
CVE-2016-7892 affects Adobe Flash Player. Specifically, affected products include adobe flash player desktop runtime, adobe flash player.
How do I fix CVE-2016-7892?
The impacted product is end-of-life and should be disconnected if still in use. Migrate to a supported product as soon as possible.
How severe is CVE-2016-7892?
CVE-2016-7892 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that poses significant risk and requires prompt remediation. The vulnerability enables unauthenticated remote attackers to potentially compromise affected Flash Player systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.