CVE-2016-4229 is a critical use-after-free vulnerability in Adobe Flash Player, impacting versions before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X, and before 11.2.202.632 on Linux. This flaw allows remote attackers to execute arbitrary code on affected systems via unspecified vectors. With a CVSS v3.1 score of 8.8 (High), it presents a significant risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability compromise. While not listed in CISA's KEV catalog, exploit code for this vulnerability, specifically leveraging BitmapData.copyPixels, is publicly available on ExploitDB. The vulnerability has garnered considerable community discussion and media coverage, indicating its recognized importance.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 22.0.0.192CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* | ||
<= 18.0.0.360CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:* | ||
<= 22.0.0.192CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 22.0.0.192CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 22.0.0.192CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.