Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2016-0984: Adobe Flash Player and AIR Use-After-Free Vulnerability

86
Patch now
HIGH 8.8EXPLOITEDUPGRADEUPGRADEUPGRADE

CVE-2016-0984 is a high-severity flaw (CVSS 8.8) affecting flash player, flash player, flash player, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

Why this priority

  • High severity
  • EPSS top 1%: very likely to be exploited
  • Exploited in the wild (CISA KEV)
  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance54.5% (top 1%)
CISA exploited listYes, fix due 2022-06-15
WeaknessCWE-416
Published2016-02-10
Last modified2026-06-17
Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

adobe flash player UPGRADE
Affected: <= 20.0.0.272
Fixed in: newer than 20.0.0.272
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 20.0.0.272 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 20.0.0.272
Fixed in: newer than 20.0.0.272
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 20.0.0.272 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 11.2.202.559 · <= 18.0.0.326
Fixed in: newer than 18.0.0.326
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 18.0.0.326 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player desktop runtime UPGRADE
Affected: <= 20.0.0.286
Fixed in: newer than 20.0.0.286
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player-desktop-runtime || rpm -q flash-player-desktop-runtime || flash-player-desktop-runtime --version
2. UPGRADE to newer than 20.0.0.286 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player-desktop-runtime
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player-desktop-runtime
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 20.0.0.286
Fixed in: newer than 20.0.0.286
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 20.0.0.286 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air desktop runtime UPGRADE
Affected: <= 20.0.0.233
Fixed in: newer than 20.0.0.233
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air-desktop-runtime || rpm -q air-desktop-runtime || air-desktop-runtime --version
2. UPGRADE to newer than 20.0.0.233 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air-desktop-runtime
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air-desktop-runtime
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · perl-Net-IDN-Encode · FIXED · 2.600-1.fc46 · FEDORA-2026-84eff0ea64 · source
sudo dnf upgrade --advisory=FEDORA-2026-84eff0ea64
Fedora ELN · libXISF · FIXED · 0.2.15-2.eln159 · FEDORA-2026-b9e2d1bda0 · source
sudo dnf upgrade --advisory=FEDORA-2026-b9e2d1bda0
RHEL 5 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.569-1.el5
sudo dnf upgrade --advisory=RHSA-2016:0166 rpm -q flash-plugin
RHEL 6 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.569-1.el6_7
sudo dnf upgrade --advisory=RHSA-2016:0166 rpm -q flash-plugin

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2016-0984?

flash player: upgrade to newer than 20.0.0.272; flash player: upgrade to newer than 20.0.0.272; flash player: upgrade to newer than 18.0.0.326. Exact commands for each OS are on this page.

Is CVE-2016-0984 being exploited?

Yes. CVE-2016-0984 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2016-0984 affect?

CVE-2016-0984 affects flash player, flash player, flash player. Severity is high (CVSS 8.8). Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK &

How urgent is CVE-2016-0984?

Priority 86/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.