CVE-2016-7892: high-severity vulnerability in Adobe Flash Player 23.0.0.207 and earlier, 11.2.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
The impacted product is end-of-life and should be disconnected if still in use.
Adobe Flash Player has a use-after-free bug in the TextField class that allows attackers to run arbitrary code on your computer. This happens when Flash tries to use text field data that has already been deleted from memory.
Use-after-free vulnerability in Adobe Flash Player's TextField class (versions ≤23.0.0.207 and ≤11.2.202.644) allows remote code execution through crafted Flash content. Exploitation requires user interaction to load malicious SWF files; successful exploitation results in arbitrary code execution with user privileges.
The full analysis of this CVE is available in Portuguese →