---
id: "CVE-2016-1010"
kind: "vulnerability"
aliases: ["CVE-2016-1010"]
title: "Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X\u2026"
severity: "critical"
cvss: 9.3
epss: 0.19333
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe Flash Player and AIR", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": "<= 20.0.0.306", "ecosystem": "vendor"}, {"name": "adobe air", "fixed": [], "affected": "<= 20.0.0.233", "ecosystem": "vendor"}, {"name": "adobe air sdk", "fixed": [], "affected": "<= 20.0.0.260", "ecosystem": "vendor"}, {"name": "samsung x14j firmware", "fixed": [], "affected": "= t-ms14jakucb-1102.5", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": [], "affected": "<= 11.2.202.569", "ecosystem": "vendor"}, {"name": "adobe flash player desktop runtime", "fixed": [], "affected": "<= 20.2.2.306", "ecosystem": "vendor"}, {"name": "adobe air desktop runtime", "fixed": [], "affected": "<= 20.0.0.260", "ecosystem": "vendor"}, {"name": "adobe air sdk \\& compiler", "fixed": [], "affected": "<= 20.0.0.260", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-air", "adobe-flash-player", "exploited", "macos", "runtime", "windows"]
not_affected_if: ["flash-not-installed"]
published_at: "2016-03-12T15:59:25+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-1010", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-1010", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1010", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X…

Adobe Flash Player and AIR contain an integer overflow that lets an attacker execute code. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Flash Player and AIR affected ? fixed ?
- vendor:adobe flash player affected <= 20.0.0.306 fixed ?
- vendor:adobe air affected <= 20.0.0.233 fixed ?
- vendor:adobe air sdk affected <= 20.0.0.260 fixed ?
- vendor:samsung x14j firmware affected = t-ms14jakucb-1102.5 fixed ?
- vendor:adobe flash player affected <= 11.2.202.569 fixed ?
- vendor:adobe flash player desktop runtime affected <= 20.2.2.306 fixed ?
- vendor:adobe air desktop runtime affected <= 20.0.0.260 fixed ?
- vendor:adobe air sdk \& compiler affected <= 20.0.0.260 fixed ?

## How to check

Check whether Adobe Flash Player or AIR is installed on endpoints or inside applications, for example via the Flash Player control panel or installed program lists.

## Fix

Remove Adobe Flash Player and AIR, since the products are end-of-life and CISA says to disconnect them if still in use.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-1010
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-1010
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-1010

## From the sources

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_