CVE-2016-1019

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2022-03-03, due 2022-03-24, known ransomware use

Published

2016-04-07

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

Affected

• adobe:air_desktop_runtime
• adobe:air_sdk
• adobe:air_sdk_\&_compiler
• adobe:flash_player
• adobe:flash_player_desktop_runtime

References

• http://blogs.adobe.com/psirt/?p=1330
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html

Check your stackJSON