CVE-2016-4272 is a use-after-free vulnerability in Adobe Flash Player versions before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X, and before 11.2.202.635 on Linux, affecting products from Adobe, Apple, Google, Linux, and Microsoft. This vulnerability carries a high CVSS score of 8.8, indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to complete compromise of confidentiality, integrity, and availability. While no public exploit code is available in Metasploit or ExploitDB, and it is not listed in the KEV catalog, it has received some community discussion and media coverage, suggesting awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 11.2.202.632CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
<= 22.0.0.211CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 22.0.0.211CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 22.0.0.211CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* | ||
<= 18.0.0.366CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.