CVE-2016-7886

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier	Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier

References

http://www.securityfocus.com/bid/94868Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037467Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/indesign/apsb16-43.htmlVendor Advisory
http://www.securityfocus.com/bid/94868Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037467Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/indesign/apsb16-43.htmlVendor Advisory

Timeline

Published: Dec 15, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-78877.5Adobe ColdFusion Builder versions 2016 update 2 and earlier, 3.0.3 and earlier have an important vulnerability that could lead to informatio CVE-2016-78885.3Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak.CVE-2016-78897.5Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure.CVE-2016-78908.8Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have security bypass vulnerability in the implementation of the CVE-2016-78916.1Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripti CVE-2016-78928.8Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFie CVE-2016-79028.8Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permi CVE-2016-79033.7Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password r CVE-2016-79048.0Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of admi CVE-2016-79055.5The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer CVE-2016-79065.5magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.CVE-2016-79074.4The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi