CVE-2016-0984: Adobe Flash Player and AIR use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, high-impact code execution flaw with public exploit code and KEV listing, but it requires user interaction and the affected products are end-of-life, so exposure depends on whether Flash or AIR remains deployed.

What it is

CVE-2016-0984 is a use-after-free (CWE-416) in Adobe Flash Player, Adobe AIR, AIR SDK and AIR SDK & Compiler that lets an attacker execute arbitrary code. It affects Flash Player before 18.0.0.329 and 19.x/20.x before 20.0.0.306 on Windows and OS X, before 11.2.202.569 on Linux, and AIR/SDK builds before 20.0.0.260. The products are end-of-life, so any remaining deployment carries unpatched risk.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the affected runtime, with high confidentiality, integrity and availability impact per the CVSS vector. In practice this means host compromise of the machine running the vulnerable player.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:R, so the flaw is reachable over the network with no privileges but requires user interaction, typically a victim loading attacker-supplied content in the vulnerable runtime. The description does not specify the exact vectors, so the precise delivery mechanism is not documented here.

Exploitation

The record is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25) and an Exploit-DB entry is referenced, indicating public exploit code exists; EPSS is 0.54823 (98.9th percentile). No ransomware campaign use is documented.

What to do

• Patch to the fixed builds: Flash Player 18.0.0.329 / 20.0.0.306 (Windows, OS X), 11.2.202.569 (Linux), and AIR/AIR SDK/AIR SDK & Compiler 20.0.0.260 or later.
• Because these products are end-of-life, remove or disconnect Flash Player and AIR from systems that still run them, per CISA's required action.
• Block or disable Flash content in browsers and email clients, and restrict untrusted web content on hosts that cannot be remediated.
• Apply the vendor and distribution advisories (Adobe APSB16-04, Red Hat RHSA-2016-0166, openSUSE, Gentoo GLSA) for any packaged deployments.

Detection

• Hunt for hosts still running Flash Player or AIR versions below the fixed builds listed above.
• Monitor for processes loading Flash/AIR content from untrusted or unusual sources, and for crashes in the Flash/AIR runtime that may indicate use-after-free attempts.
• Alert on network retrieval of SWF or Flash-embedded content from untrusted origins on hosts that still have the runtime installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.