Live › vulnerability › CVE-2016-1010
Go to dashboardAdobe Flash Player and AIR contain an integer overflow that lets an attacker execute code. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted products are end-of-life and should be disconnected if still in use.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Flash Player and AIR | vendor | – | – |
| adobe flash player | vendor | <= 20.0.0.306 | – |
| adobe air | vendor | <= 20.0.0.233 | – |
| adobe air sdk | vendor | <= 20.0.0.260 | – |
| samsung x14j firmware | vendor | = t-ms14jakucb-1102.5 | – |
| adobe flash player | vendor | <= 11.2.202.569 | – |
| adobe flash player desktop runtime | vendor | <= 20.2.2.306 | – |
| adobe air desktop runtime | vendor | <= 20.0.0.260 | – |
| adobe air sdk \& compiler | vendor | <= 20.0.0.260 | – |
Check whether Adobe Flash Player or AIR is installed on endpoints or inside applications, for example via the Flash Player control panel or installed program lists.
Remove Adobe Flash Player and AIR, since the products are end-of-life and CISA says to disconnect them if still in use.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
This page as .md · .json · in your agent: get_signal("CVE-2016-1010")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.