CVE-2016-6986 is a memory corruption vulnerability in Adobe Flash Player, affecting versions before 18.0.0.382, 19.x through 23.x before 23.0.0.185 on Windows/OS X, and before 11.2.202.637 on Linux. This high-severity vulnerability, with a CVSS score of 8.8, allows unauthenticated attackers to execute arbitrary code or cause a denial of service through unspecified vectors, requiring user interaction. While no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available, it garnered moderate community discussion and media coverage at the time of its disclosure. It is not listed in CISA's KEV catalog and is considered inactive on the Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 23.0.0.162CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 23.0.0.162CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 23.0.0.162CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* | ||
<= 18.0.0.375CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:* | ||
<= 23.0.0.162CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.