CVE-2016-7892

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier	Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

References

http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2947.htmlThird Party Advisory
http://www.securityfocus.com/bid/94877Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037442Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-39.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-17Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2947.htmlThird Party Advisory
http://www.securityfocus.com/bid/94877Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037442Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-154Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-39.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201701-17Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892US Government Resource

Timeline

Published: Dec 15, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-79028.8Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permi CVE-2016-79033.7Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password r CVE-2016-79048.0Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of admi CVE-2016-79055.5The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer CVE-2016-79065.5magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.CVE-2016-79074.4The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi CVE-2016-79084.4The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi CVE-2016-79094.4The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of servic CVE-2016-79107.8Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain pri CVE-2016-79117.8Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or c CVE-2016-79127.8Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 all CVE-2016-79137.8The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges o