CVE-2016-1010

Adobe Flash Player and AIR: Integer Overflow

As of , CVE-2016-1010 in Adobe Flash Player and AIR is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 25 May 2022
US federal deadline
15 June 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.19Higher than 97% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.04 on 25 May 2022EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

The impacted products are end-of-life and should be disconnected if still in use.

CISA's required action

What the flaw is

Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.

CISA's description

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

The CVE record's description, from adobe

CVE published
12 March 2016
Assigned by
adobe
CVSS
8.8 High (CVSS 3.1, from CISA-ADP)
CWE-190
Integer Overflow or Wraparound
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Flash Player and AIR: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2016-0984Use-After-FreeAdobe Flash Player and AIRPatch this weekEPSS 0.55; verified Exploit-DB entry0.55

Read further