CVE-2016-0984

Adobe Flash Player and Adobe AIR contain a use-after-free memory corruption flaw (CWE-416) that allows remote attackers to execute arbitrary code by persuading a user to load specially crafted Flash content, as the CVSS vector (AV:N/UI:R) indicates exploitation via user interaction such as opening a malicious SWF in a browser or an application embedding Flash/AIR. Successful exploitation gives the attacker code execution with the victim user's privileges, with high impact on confidentiality, integrity, and availability. All Flash Player versions before 18.0.0.329, 19.x/20.x before 20.0.0.306 on Windows and OS X, and before 11.2.202.569 on Linux are affected, along with Adobe AIR Desktop Runtime, AIR SDK, and AIR SDK & Compiler before 20.0.0.260. The flaw was fixed in February 2016 as one of several sibling use-after-free bugs (CVE-2016-0973, -0974, -0975, -0982, -0983), and a public proof of concept is available (Exploit-DB 39462). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, confirming known in-the-wild exploitation (ransomware use unknown), and EPSS at 54.8% (99th percentile) indicates continued likelihood of exploitation against remaining exposed systems.

What to do: Upgrade Flash Player to 18.0.0.329, or 20.0.0.306 on Windows/macOS and 11.2.202.569 on Linux, and upgrade AIR, AIR SDK, and AIR SDK & Compiler to 20.0.0.260. Because Flash is end-of-life, per CISA KEV guidance the preferred action is to remove or disable Flash entirely and disconnect any system still running it; audit legacy browsers, kiosks, industrial HMIs, and embedded apps that still load SWF content, since exploitation requires user-opened Flash content.