Vulnerability record · CVE-2016-1019 · published 7 April 2016
CVE-2016-1019: Adobe Flash Player memory corruption allows code execution
Adobe · Flash Player Desktop Runtime
Adobe Flash Player 21.0.0.197 and earlier contains an unspecified memory corruption flaw that can crash the application or allow arbitrary code execution. Adobe confirmed it was exploited in the wild in April 2016, making it a real-world attack vector rather than a theoretical bug. The record gives no root-cause detail (CWE is 'noinfo'), so the exact vulnerable code path is unknown.
Description
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, confirmed in-the-wild exploitation, KEV listing with ransomware association, and an end-of-life product that cannot be patched make this a top remediation priority.
What it is
Adobe Flash Player 21.0.0.197 and earlier contains an unspecified memory corruption flaw that can crash the application or allow arbitrary code execution. Adobe confirmed it was exploited in the wild in April 2016, making it a real-world attack vector rather than a theoretical bug. The record gives no root-cause detail (CWE is 'noinfo'), so the exact vulnerable code path is unknown.
Impact
An attacker can crash the Flash process or execute arbitrary code in its context, which typically means code execution with the privileges of the user running the browser or Flash runtime. Successful exploitation can lead to full host compromise and, per CISA, has been associated with ransomware campaigns.
Attack surface
Reachable remotely over the network with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), though in practice delivery is via a malicious or compromised web page or embedded Flash content. Any host still running Flash Player 21.0.0.197 or earlier is exposed.
Exploitation
Adobe stated it was exploited in the wild in April 2016, and CISA added it to KEV on 2022-03-03 with known ransomware campaign use. EPSS is 0.22487 (97.6th percentile), indicating elevated predicted exploitation activity.
What to do
- Patch or remove Flash Player immediately; Adobe Flash Player is end-of-life, so uninstall it rather than relying on updates.
- Follow CISA KEV guidance: disconnect end-of-life Flash-bearing systems if they cannot be removed or isolated.
- Apply the Microsoft MS16-050 update for the bundled Flash component on affected Windows systems.
- Block Flash content in browsers and disable the plugin enterprise-wide via policy.
- Restrict outbound browsing and email attachments on systems that cannot drop Flash, and segment them from critical assets.
Detection
- Hunt for Flash Player versions 21.0.0.197 or earlier across endpoints and browsers.
- Monitor for Flash process crashes (flash player plugin/browser child processes) followed by suspicious child process creation.
- Alert on network fetches of .swf content from untrusted or newly registered domains.
- Review endpoint telemetry for code execution originating from browser or Flash plugin processes, especially on hosts with known ransomware precursor activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-1019 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Adobe Flash Player Arbitrary Code Execution Vulnerability". CISA reports known use in ransomware campaigns. Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 24 March 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-1019 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-1019), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
