ByteOS

Product:XML Core Services

Added At:08 Jun, 2022

Due At:22 Jun, 2022

Microsoft XML Core Services Memory Corruption Vulnerability

Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.

Used in Ransomware

Unknown

CWE

CWE-119

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2012-1889

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:13 Jun, 2012 | 01:00

Updated At:22 Oct, 2025 | 00:05

▼CVE Numbering Authority (CNA)

Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.us-cert.gov/cas/techalerts/TA12-192A.html	third-party-advisory x_refsource_CERT
http://technet.microsoft.com/security/advisory/2719615	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195	vdb-entry signature x_refsource_OVAL
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043	vendor-advisory x_refsource_MS
http://www.us-cert.gov/cas/techalerts/TA12-174A.html	third-party-advisory x_refsource_CERT

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Resource:

third-party-advisory

x_refsource_CERT

Hyperlink: http://technet.microsoft.com/security/advisory/2719615

Resource:

x_refsource_CONFIRM

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-174A.html

Resource:

third-party-advisory

x_refsource_CERT

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.us-cert.gov/cas/techalerts/TA12-192A.html	third-party-advisory x_refsource_CERT x_transferred
http://technet.microsoft.com/security/advisory/2719615	x_refsource_CONFIRM x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195	vdb-entry signature x_refsource_OVAL x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043	vendor-advisory x_refsource_MS x_transferred
http://www.us-cert.gov/cas/techalerts/TA12-174A.html	third-party-advisory x_refsource_CERT x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

Hyperlink: http://technet.microsoft.com/security/advisory/2719615

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-174A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-787	CWE-787 Out-of-bounds Write

Type: CWE

CWE ID: CWE-787

Description: CWE-787 Out-of-bounds Write

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-06-08

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889

Timeline

Event	Date
CVE-2012-1889 added to CISA KEV	2022-06-08 00:00:00

Event: CVE-2012-1889 added to CISA KEV

Date: 2022-06-08 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:13 Jun, 2012 | 04:46

Updated At:22 Oct, 2025 | 01:15

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-06-08	2022-06-22	Microsoft XML Core Services Memory Corruption Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-06-08

Due Date: 2022-06-22

Vulnerability Name: Microsoft XML Core Services Memory Corruption Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*

>>xml_core_services>>3.0

cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*

>>xml_core_services>>4.0

cpe:2.3:a:microsoft:xml_core_services:6.0:*:*:*:*:*:*:*

>>xml_core_services>>6.0

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*

>>windows_7>>-

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

>>windows_7>>-

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

>>windows_8>>-

cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*

>>windows_server_2003>>-

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

>>windows_server_2003>>-

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

>>windows_server_2008>>-

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

>>windows_server_2012>>-

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

>>windows_vista>>-

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

>>windows_xp>>-

cpe:2.3:a:microsoft:xml_core_services:5.0:*:*:*:*:*:*:*

>>xml_core_services>>5.0

cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:*

>>expression_web>>2

cpe:2.3:a:microsoft:expression_web:sp1:*:*:*:*:*:*:*

>>expression_web>>sp1

cpe:2.3:a:microsoft:groove:2007:sp2:*:*:*:*:*:*

>>groove>>2007

cpe:2.3:a:microsoft:groove:2007:sp3:*:*:*:*:*:*

>>groove>>2007

cpe:2.3:a:microsoft:groove_server:2007:sp2:*:*:*:*:*:*

>>groove_server>>2007

cpe:2.3:a:microsoft:groove_server:2007:sp3:*:*:*:*:*:*

>>groove_server>>2007

cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*

>>office>>2003

cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*

>>office>>2007

cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*

>>office>>2007

cpe:2.3:a:microsoft:office_compatibility_pack:-:sp2:*:*:*:*:*:*

>>office_compatibility_pack>>-

cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*

>>office_compatibility_pack>>-

cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*

>>office_word_viewer>>-

cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:*:*:*:*:*:*

>>sharepoint_server>>2007

cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*

>>sharepoint_server>>2007

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-787	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-787

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://technet.microsoft.com/security/advisory/2719615	secure@microsoft.com	Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA12-174A.html	secure@microsoft.com	Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-192A.html	secure@microsoft.com	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043	secure@microsoft.com	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195	secure@microsoft.com	Broken Link
http://technet.microsoft.com/security/advisory/2719615	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA12-174A.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-192A.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A

Hyperlink: http://technet.microsoft.com/security/advisory/2719615

Source: secure@microsoft.com

Resource:

Vendor Advisory

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-174A.html

Source: secure@microsoft.com

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Source: secure@microsoft.com

Resource:

Third Party Advisory

US Government Resource

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195

Source: secure@microsoft.com

Resource:

Broken Link

Hyperlink: http://technet.microsoft.com/security/advisory/2719615

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-174A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-192A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

US Government Resource

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource: N/A

Similar CVEs

6508Records found

CVE-2018-4937

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 29.0.0.113 and earlier versions

CVSS Score-8.8||HIGH

EPSS-74.18% / 98.80%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4179

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-50.21% / 97.76%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4219

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24094

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-1.35% / 79.76%

7 Day CHG~0.00%

Published-11 Mar, 2022 | 17:54

Updated-23 Apr, 2025 | 18:55

Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution

Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows macos after_effects After Effects

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4122

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.64%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-13042

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.10% / 28.10%

7 Day CHG~0.00%

Published-12 Nov, 2025 | 16:48

Updated-25 Nov, 2025 | 15:03

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

Product-chrome macos windows linux_kernel Chrome

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4187

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-4935

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 29.0.0.113 and earlier versions

CVSS Score-8.8||HIGH

EPSS-74.18% / 98.80%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4182

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-11.54% / 93.46%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4220

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2008-5232

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-33.79% / 96.84%

7 Day CHG~0.00%

Published-26 Nov, 2008 | 01:00

Updated-07 Aug, 2024 | 10:49

Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media and Message Application servers, allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-n/a Microsoft Corporation

Product-windows_nt windows_2000 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4181

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2008-3471

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-66.32% / 98.48%

7 Day CHG~0.00%

Published-15 Oct, 2008 | 00:00

Updated-07 Aug, 2024 | 09:37

Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."

Vendor-n/a Microsoft Corporation

Product-open_xml_file_format_converter office excel_viewer office_compatibility_pack excel n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-11205

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-10

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.08% / 24.67%

7 Day CHG~0.00%

Published-06 Nov, 2025 | 22:08

Updated-13 Nov, 2025 | 15:31

Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Linux Kernel Organization, Inc Apple Inc.Google LLC Microsoft Corporation

Product-chrome windows macos linux_kernel Chrome

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4234

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4241

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4235

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4180

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4249

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-10.45% / 93.07%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4245

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4154

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4172

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4127

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.64%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4280

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.31% / 86.96%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4177

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-48.23% / 97.65%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4184

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4276

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.31% / 86.96%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4218

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4217

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-5.20% / 89.68%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4166

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.67% / 87.62%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4185

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-6.89% / 91.19%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4153

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4233

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4244

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4190

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4240

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4246

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.90% / 88.00%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4245.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4125

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-2.74% / 85.64%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4155

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4151

Matching Score-10

Matching Score-10

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-4.25% / 88.54%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4175

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-50.21% / 97.76%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-2314

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.02% / 5.07%

7 Day CHG~0.00%

Published-11 Feb, 2026 | 18:08

Updated-13 Feb, 2026 | 17:27

Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation Google LLC

Product-chrome linux_kernel macos windows Chrome

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-0899

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.08% / 23.70%

7 Day CHG~0.00%

Published-20 Jan, 2026 | 04:14

Updated-29 Jan, 2026 | 20:20

Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Google LLC Apple Inc.

Product-linux_kernel chrome macos windows Chrome

CWE ID-CWE-125

Out-of-bounds Read

CWE ID-CWE-787

Out-of-bounds Write

CVE-2026-1861

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.03% / 7.12%

7 Day CHG+0.01%

Published-03 Feb, 2026 | 20:56

Updated-11 Feb, 2026 | 18:32

Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation Google LLC

Product-chrome linux_kernel macos windows Chrome

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-9132

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.13% / 32.99%

7 Day CHG~0.00%

Published-20 Aug, 2025 | 00:41

Updated-21 Aug, 2025 | 18:25

Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Google LLC Apple Inc.Linux Kernel Organization, Inc Microsoft Corporation

Product-windows macos chrome linux_kernel Chrome

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1024

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.37%

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-0977

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.59% / 88.98%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-30614

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-3.38% / 87.11%

7 Day CHG~0.00%

Published-03 Sep, 2021 | 19:25

Updated-03 Aug, 2024 | 22:40

Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip

Vendor-Fedora Project Microsoft Corporation

Product-edge_chromium fedora edge Microsoft Edge (Chromium-based)

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1023

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-2.85% / 85.91%

7 Day CHG-1.27%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-0979

Matching Score-10

Matching Score-10