CVE-2016-7880

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property of an array object. Successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier	Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

References

http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2947.htmlThird Party Advisory
http://www.securityfocus.com/bid/94873Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037442Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-39.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-17Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2947.htmlThird Party Advisory
http://www.securityfocus.com/bid/94873Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037442Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-39.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-17Third Party Advisory

Timeline

Published: Dec 15, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-78818.8Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieCl CVE-2016-78826.1Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scr CVE-2016-78836.1Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attack CVE-2016-78846.1Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site s CVE-2016-78858.8Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks.CVE-2016-78869.8Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Suc CVE-2016-78877.5Adobe ColdFusion Builder versions 2016 update 2 and earlier, 3.0.3 and earlier have an important vulnerability that could lead to informatio CVE-2016-78885.3Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak.CVE-2016-78897.5Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure.CVE-2016-78908.8Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have security bypass vulnerability in the implementation of the CVE-2016-78916.1Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripti CVE-2016-78928.8Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFie