CVE-2016-1019
critical CISA KEVAdobe Flash Player Arbitrary Code Execution Vulnerability
Vendor / product: Adobe — Flash Player
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2016-04-07 10:59
Modified: 2026-10-01 20:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2022-03-03 · due 2022-03-24
Known ransomware use: Known
Required action (CISA)
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
adobe / flash_player_desktop_runtime ≤21.0.0.197
adobe / flash_player ≤18.0.0.333, ≤21.0.0.197, ≤11.2.202.577
adobe / air_desktop_runtime ≤21.0.0.176
adobe / air_sdk ≤21.0.0.176
adobe / air_sdk_\&_compiler ≤21.0.0.176
Weakness classification (CWE)
NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: http://blogs.adobe.com/psirt/?p=1330
Vendor advisory: http://blogs.adobe.com/psirt/?p=1330
References
- http://blogs.adobe.com/psirt/?p=1330 psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html psirt@adobe.com
- http://rhn.redhat.com/errata/RHSA-2016-0610.html psirt@adobe.com
- http://www.securityfocus.com/bid/85856 psirt@adobe.com
- http://www.securitytracker.com/id/1035491 psirt@adobe.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 psirt@adobe.com
- https://helpx.adobe.com/security/products/flash-player/apsa16-01.html psirt@adobe.com
- https://helpx.adobe.com/security/products/flash-player/apsb16-10.html psirt@adobe.com
- https://security.gentoo.org/glsa/201606-08 psirt@adobe.com
- https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html psirt@adobe.com
- http://blogs.adobe.com/psirt/?p=1330 af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html af854a3a-2127-422b-91ae-364da2661108
- http://rhn.redhat.com/errata/RHSA-2016-0610.html af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/85856 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1035491 af854a3a-2127-422b-91ae-364da2661108
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗