CVE WatchSep 10, 2026

CVE-2016-4117

Adobe Flash Player Arbitrary Code Execution Vulnerability

CVSS

9.8

Critical

EPSS

94.4%

p100

KEV

YES

Mar 3, 2022

Exploit Today

0-100

Published: May 11, 2016 · Last modified: Sep 10, 2026

EPSS · 30d

94.4%EPSS · 30 days94.4%

2026-09-162026-10-14

KEV catalog record

Product

Adobe / Flash Player

Vulnerability

Adobe Flash Player Arbitrary Code Execution Vulnerability

Added to KEV

Mar 3, 2022

Remediate by

Mar 24, 2022

Known ransomware use

Yes

Summary description

An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-4117

Technical description

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2018-159827.8 HIG

99.8%

KEV—80Adobe Flash Player Use-After-Free Vulnerability14d CVE-2016-10199.8 CRI

97.7%

KEV—79Adobe Flash Player Arbitrary Code Execution Vulnerability14d CVE-2014-0497—

100.0%

KEV—80Adobe Flash Player Integer Underflow Vulnerablity—CVE-2015-3113—

100.0%

KEV—80Adobe Flash Player Heap-Based Buffer Overflow Vulnerability—CVE-2011-0611—

99.9%

KEV—80Adobe Flash Player Remote Code Execution Vulnerability—CVE-2015-5119—

99.9%

KEV—80Adobe Flash Player Use-After-Free Vulnerability—