Live › vulnerability › CVE-2016-0984
Go to dashboardAdobe Flash Player and Adobe AIR contain a use-after-free memory bug that lets an attacker execute code. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted products are end-of-life and should be disconnected if still in use.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Flash Player and AIR | vendor | – | – |
| adobe flash player | vendor | <= 20.0.0.272 | – |
| adobe flash player | vendor | <= 11.2.202.559 | – |
| adobe flash player desktop runtime | vendor | <= 20.0.0.286 | – |
| adobe flash player | vendor | <= 18.0.0.326 | – |
| adobe flash player | vendor | <= 20.0.0.286 | – |
| adobe air desktop runtime | vendor | <= 20.0.0.233 | – |
| adobe air sdk | vendor | <= 20.0.0.233 | – |
| adobe air sdk \& compiler | vendor | <= 20.0.0.233 | – |
Look for Adobe Flash Player or Adobe AIR installed on endpoints and servers; the sources do not give a version check command.
Remove Adobe Flash Player and Adobe AIR from systems, since the products are end-of-life and CISA says to disconnect them if still in use.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
This page as .md · .json · in your agent: get_signal("CVE-2016-0984")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.