Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2016-4121: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 o

63
This week
CRITICAL 9.8REMOTEUPGRADEUPGRADEUPGRADE

CVE-2016-4121 is a critical-severity flaw (CVSS 9.8) affecting flash player, flash player, flash player. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, and CVE-2016-4110.

Why this priority

  • Critical severity
  • EPSS top 4%: very likely to be exploited
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance10.0% (top 4%)
CISA exploited listNo
WeaknessCWE-416
Published2016-06-16
Last modified2026-06-17
Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

adobe flash player UPGRADE
Affected: <= 21.0.0.241
Fixed in: newer than 21.0.0.241
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 21.0.0.241 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 21.0.0.241
Fixed in: newer than 21.0.0.241
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 21.0.0.241 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 18.0.0.343 · <= 11.2.202.616
Fixed in: newer than 18.0.0.343
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 18.0.0.343 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air sdk \& compiler UPGRADE
Affected: <= 21.0.0.198
Fixed in: newer than 21.0.0.198
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air-sdk--compiler || rpm -q air-sdk--compiler || air-sdk--compiler --version
2. UPGRADE to newer than 21.0.0.198 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air-sdk--compiler
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air-sdk--compiler
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe air sdk UPGRADE
Affected: <= 21.0.0.198
Fixed in: newer than 21.0.0.198
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy air-sdk || rpm -q air-sdk || air-sdk --version
2. UPGRADE to newer than 21.0.0.198 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade air-sdk
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade air-sdk
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
adobe flash player UPGRADE
Affected: <= 21.0.0.216
Fixed in: newer than 21.0.0.216
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy flash-player || rpm -q flash-player || flash-player --version
2. UPGRADE to newer than 21.0.0.216 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade flash-player
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade flash-player
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2016-4121?

flash player: upgrade to newer than 21.0.0.241; flash player: upgrade to newer than 21.0.0.241; flash player: upgrade to newer than 18.0.0.343. Exact commands for each OS are on this page.

Is CVE-2016-4121 being exploited?

CVE-2016-4121 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2016-4121 affect?

CVE-2016-4121 affects flash player, flash player, flash player. Severity is critical (CVSS 9.8). Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a differen

How urgent is CVE-2016-4121?

Priority 63/100. Critical severity; EPSS top 4%: very likely to be exploited; Remotely exploitable, no login, no user action

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.