ByteOS

Product:Flash Player

Added At:08 Jun, 2022

Due At:22 Jun, 2022

Adobe Flash Player Memory Corruption Vulnerability

Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Used in Ransomware

Unknown

CWE

CWE-787

Required Action:

The impacted product is end-of-life and should be disconnected if still in use.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2012-0754

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:16 Feb, 2012 | 19:00

Updated At:17 Nov, 2025 | 20:14

▼CVE Numbering Authority (CNA)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973	vdb-entry signature x_refsource_OVAL
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html	vendor-advisory x_refsource_SUSE
http://security.gentoo.org/glsa/glsa-201204-07.xml	vendor-advisory x_refsource_GENTOO
http://secunia.com/advisories/48265	third-party-advisory x_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030	vdb-entry signature x_refsource_OVAL
http://www.adobe.com/support/security/bulletins/apsb12-03.html	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2012-0144.html	vendor-advisory x_refsource_REDHAT
http://secunia.com/advisories/48819	third-party-advisory x_refsource_SECUNIA

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-07.xml

Resource:

vendor-advisory

x_refsource_GENTOO

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.adobe.com/support/security/bulletins/apsb12-03.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://rhn.redhat.com/errata/RHSA-2012-0144.html

Resource:

vendor-advisory

x_refsource_REDHAT

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973	vdb-entry signature x_refsource_OVAL x_transferred
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html	vendor-advisory x_refsource_SUSE x_transferred
http://security.gentoo.org/glsa/glsa-201204-07.xml	vendor-advisory x_refsource_GENTOO x_transferred
http://secunia.com/advisories/48265	third-party-advisory x_refsource_SECUNIA x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030	vdb-entry signature x_refsource_OVAL x_transferred
http://www.adobe.com/support/security/bulletins/apsb12-03.html	x_refsource_CONFIRM x_transferred
http://rhn.redhat.com/errata/RHSA-2012-0144.html	vendor-advisory x_refsource_REDHAT x_transferred
http://secunia.com/advisories/48819	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-07.xml

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://www.adobe.com/support/security/bulletins/apsb12-03.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://rhn.redhat.com/errata/RHSA-2012-0144.html

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-06-08

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0754

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0754	government-resource
https://github.com/cisagov/vulnrichment/issues/196	issue-tracking

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0754

Resource:

government-resource

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Resource:

issue-tracking

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:16 Feb, 2012 | 19:55

Updated At:17 Nov, 2025 | 21:15

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-06-08	2022-06-22	Adobe Flash Player Memory Corruption Vulnerability	The impacted product is end-of-life and should be disconnected if still in use.

Date Added: 2022-06-08

Due Date: 2022-06-22

Vulnerability Name: Adobe Flash Player Memory Corruption Vulnerability

Required Action: The impacted product is end-of-life and should be disconnected if still in use.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

>>flash_player>>Versions before 10.3.183.15(exclusive)

>>flash_player>>Versions from 11.0(inclusive) to 11.1.102.62(exclusive)

cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*

Apple Inc.

>>mac_os_x>>-

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows>>-

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Oracle Corporation

>>solaris>>-

cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*

>>flash_player>>Versions before 11.1.111.6(exclusive)

cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

Google LLC

>>android>>Versions from 2.0(inclusive) to 3.2(inclusive)

>>flash_player>>Versions before 11.1.115.6(exclusive)

cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*

Google LLC

>>android>>4.0

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html	psirt@adobe.com	Broken Link
http://rhn.redhat.com/errata/RHSA-2012-0144.html	psirt@adobe.com	Third Party Advisory
http://secunia.com/advisories/48265	psirt@adobe.com	Broken Link
http://secunia.com/advisories/48819	psirt@adobe.com	Broken Link
http://security.gentoo.org/glsa/glsa-201204-07.xml	psirt@adobe.com	Third Party Advisory
http://www.adobe.com/support/security/bulletins/apsb12-03.html	psirt@adobe.com	Broken Link Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030	psirt@adobe.com	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973	psirt@adobe.com	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://rhn.redhat.com/errata/RHSA-2012-0144.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://secunia.com/advisories/48265	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/48819	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://security.gentoo.org/glsa/glsa-201204-07.xml	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.adobe.com/support/security/bulletins/apsb12-03.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://github.com/cisagov/vulnrichment/issues/196	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0754	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://rhn.redhat.com/errata/RHSA-2012-0144.html

Source: psirt@adobe.com

Resource:

Third Party Advisory

Source: psirt@adobe.com

Resource:

Broken Link

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-07.xml

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: http://www.adobe.com/support/security/bulletins/apsb12-03.html

Source: psirt@adobe.com

Resource:

Broken Link

Patch

Vendor Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://rhn.redhat.com/errata/RHSA-2012-0144.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-07.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.adobe.com/support/security/bulletins/apsb12-03.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Patch

Vendor Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15030

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15973

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource: N/A

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0754

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource: N/A

Similar CVEs

13469Records found

CVE-2018-4937

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 29.0.0.113 and earlier versions

CVSS Score-8.8||HIGH

EPSS-74.18% / 98.80%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4179

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-50.21% / 97.76%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-35699

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.18% / 38.98%

7 Day CHG~0.00%

Published-19 Sep, 2022 | 15:47

Updated-23 Apr, 2025 | 16:58

Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-windows bridge macos Bridge

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4219

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24094

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-1.35% / 79.76%

7 Day CHG~0.00%

Published-11 Mar, 2022 | 17:54

Updated-23 Apr, 2025 | 18:55

Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution

Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-windows macos after_effects After Effects

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4122

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.64%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4187

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-4935

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 29.0.0.113 and earlier versions

CVSS Score-8.8||HIGH

EPSS-74.18% / 98.80%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-5002

Matching Score-10

Matching Score-10

Product-enterprise_linux_server chrome_os enterprise_linux_desktop windows_10 windows flash_player_desktop_runtime linux_kernel flash_player windows_8.1 enterprise_linux_workstation mac_os_x Adobe Flash Player 29.0.0.171 and earlier versions Flash Player

CVSS Score-7.8||HIGH

EPSS-48.41% / 97.66%

7 Day CHG-0.07%

Published-09 Jul, 2018 | 19:00

Updated-18 Nov, 2025 | 17:03

Known KEV||Action Due Date - 2022-06-13||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Apple Inc.Google LLC Adobe Inc.

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-3930

Matching Score-10

Assigner-Talos

Matching Score-10

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-1.12% / 77.91%

7 Day CHG~0.00%

Published-11 Jul, 2018 | 16:00

Updated-16 Sep, 2024 | 19:14

In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document can lead to an out-of-bounds write, resulting in remote code execution. This vulnerability occurs in the `vbgetfp` method.

Vendor-antennahouse Antenna House Linux Kernel Organization, Inc

Product-linux_kernel office_server_document_converter Antenna House

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-17413

Matching Score-10

Assigner-Zero Day Initiative

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-7.8||HIGH

EPSS-2.84% / 85.88%

7 Day CHG~0.00%

Published-13 Oct, 2020 | 17:10

Updated-04 Aug, 2024 | 13:53

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11226.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-windows 3d PhantomPDF

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-4249

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.06% / 77.24%

7 Day CHG~0.00%

Published-08 Jun, 2018 | 00:00

Updated-05 Aug, 2024 | 05:11

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves pktmnglr_ipfilter_input in com.apple.packet-mangler in the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (integer overflow and stack-based buffer overflow) via a crafted app.

Vendor-n/a Apple Inc.

Product-apple_tv iphone_os watchos mac_os_x n/a

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2016-4182

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-11.54% / 93.46%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4220

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2008-5232

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-33.79% / 96.84%

7 Day CHG~0.00%

Published-26 Nov, 2008 | 01:00

Updated-07 Aug, 2024 | 10:49

Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media and Message Application servers, allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-n/a Microsoft Corporation

Product-windows_nt windows_2000 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-25018

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.41% / 60.82%

7 Day CHG~0.00%

Published-01 Jul, 2021 | 02:54

Updated-05 Aug, 2024 | 12:26

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.

Vendor-n/a Linux Kernel Organization, Inc RARLAB (WinRAR)

Product-unrar linux_kernel n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4181

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-0458

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.35% / 57.03%

7 Day CHG~0.00%

Published-14 Dec, 2020 | 21:51

Updated-04 Aug, 2024 | 06:02

In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-8.0 Android-8.1Android ID: A-160265164

Vendor-n/a Google LLC

Product-android Android

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2008-3471

Matching Score-10

Matching Score-10

CVSS Score-9.3||HIGH

EPSS-66.32% / 98.48%

7 Day CHG~0.00%

Published-15 Oct, 2008 | 00:00

Updated-07 Aug, 2024 | 09:37

Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."

Vendor-n/a Microsoft Corporation

Product-open_xml_file_format_converter office excel_viewer office_compatibility_pack excel n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2008-2992

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-93.74% / 99.84%

7 Day CHG~0.00%

Published-04 Nov, 2008 | 18:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-03-24||Apply updates per vendor instructions.

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

Vendor-n/a Adobe Inc.Oracle Corporation

Product-acrobat_reader acrobat solaris n/a Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-35700

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.18% / 38.98%

7 Day CHG~0.00%

Published-19 Sep, 2022 | 15:47

Updated-23 Apr, 2025 | 16:57

Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Product-windows bridge macos Bridge

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4234

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4241

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4235

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4180

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4249

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-10.45% / 93.07%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4245

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4154

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4172

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-35667

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.42% / 61.20%

7 Day CHG~0.00%

Published-11 Aug, 2022 | 14:44

Updated-23 Apr, 2025 | 17:52

Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4127

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.64%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-0938

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-89.57% / 99.54%

7 Day CHG+0.16%

Published-15 Apr, 2020 | 15:12

Updated-29 Oct, 2025 | 14:26

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.

Vendor-Microsoft Corporation

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4280

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.31% / 86.96%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4177

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-48.23% / 97.65%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4184

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8688

Matching Score-10

Assigner-Apple Inc.

Product-enterprise_linux_server itunes iphone_os watchos tvos safari enterprise_linux_workstation mac_os_x enterprise_linux_desktop icloud iCloud for Windows (Microsoft Store)iTunes for Windows watchOS Safari macOS iCloud for Windows iOS tvOS

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-5.13% / 89.62%

7 Day CHG+0.87%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Red Hat, Inc.Apple Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-21352

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.03% / 6.25%

7 Day CHG~0.00%

Published-10 Feb, 2026 | 18:32

Updated-13 Feb, 2026 | 20:37

DNG SDK | Out-of-bounds Write (CWE-787)

DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.

Product-dng_software_development_kit DNG SDK

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4276

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.31% / 86.96%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-35713

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.12% / 31.18%

7 Day CHG~0.00%

Published-16 Sep, 2022 | 17:16

Updated-23 Apr, 2025 | 17:08

Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-windows photoshop macos Photoshop

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4218

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4217

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-5.20% / 89.68%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30916

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.39% / 59.27%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 18:50

Updated-03 Aug, 2024 | 22:48

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os ipad_os watchos ipados tvos mac_os_x macos macOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4166

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.67% / 87.62%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4185

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-6.89% / 91.19%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30766

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.55% / 67.28%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:46

Updated-03 Aug, 2024 | 22:40

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x Security Update - Catalina macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-31473

Matching Score-10

Assigner-Zero Day Initiative

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-7.8||HIGH

EPSS-6.08% / 90.54%

7 Day CHG~0.00%

Published-21 May, 2021 | 14:40

Updated-03 Aug, 2024 | 23:03

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the browseForDoc function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13523.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2007-6427

Matching Score-10

Assigner-MITRE Corporation

Product-ubuntu_linux linux_enterprise_software_development_kit linux_enterprise_server debian_linux opensuse fedora mac_os_x linux open_enterprise_server linux_enterprise_desktop x_server n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-4.24% / 88.53%

7 Day CHG+0.50%

Published-18 Jan, 2008 | 22:00

Updated-07 Aug, 2024 | 16:02

The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.

Vendor-n/a Apple Inc.X.Org Foundation Fedora Project Canonical Ltd.Debian GNU/Linux SUSE openSUSE

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4153

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4656

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-67.91% / 98.54%

7 Day CHG+1.17%

Published-25 Aug, 2016 | 21:00

Updated-22 Oct, 2025 | 00:15

Known KEV||Action Due Date - 2022-06-14||Apply updates per vendor instructions.

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os n/a iOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4233

Matching Score-10

Matching Score-10