CVE-2016-7892

HIGH

8.8

CVSS Score

Published: December 15, 2016 at 06:31 AM UTC

Updated: June 17, 2026 at 12:53 AM UTC

2 products affected across 1 vendorFlash PlayerFlash Player Desktop Runtime· also runs on 6 platforms

Using Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier by N/A?

Get instant alerts when new vulnerabilities affect Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 19%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score18.8%

EPSS (Exploit Prediction Scoring System) estimates a 18.8% chance this CVE is exploited in the wild within the next 30 days — higher than 97% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.

Required Action

The impacted product is end-of-life and should be disconnected if still in use.

Ransomware Use

Unknown

Added to KEV

Mar 25, 2022

Remediation Due

Apr 15, 2022

1656 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-7892

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Flash Player · Adobe

95%

v ≤ 11.2.202.644v ≤ 23.0.0.207

apple-macos (environment) · google-chrome-os (environment) · linux-linux-kernel (environment) · microsoft-windows (environment) · microsoft-windows-10 (environment) · microsoft-windows-8-1 (environment)

Flash Player Desktop Runtime · Adobe

95%

v ≤ 23.0.0.207

apple-macos (environment) · microsoft-windows (environment)