CVE-2020-3982 | ByteOS Network

Vulnerability Details :

CVE-2020-3982

Assigner-vmware

Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d

Published At-20 Oct, 2020 | 16:09

Updated At-04 Aug, 2024 | 07:52

VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:vmware

Assigner Org ID:dcf2e128-44bd-42ed-91e8-88f912c1401d

Published At:20 Oct, 2020 | 16:09

Updated At:04 Aug, 2024 | 07:52

▼CVE Numbering Authority (CNA)

VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.

Affected Products

Vendor

Product

VMware ESXi, Workstation, Fusion

Versions

Affected

VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6)

Problem Types

Type	CWE ID	Description
text	N/A	Out-of-bounds write vulnerability

Type: text

CWE ID: N/A

Description: Out-of-bounds write vulnerability

References

Hyperlink	Resource
https://www.vmware.com/security/advisories/VMSA-2020-0023.html	x_refsource_MISC

Hyperlink: https://www.vmware.com/security/advisories/VMSA-2020-0023.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.vmware.com/security/advisories/VMSA-2020-0023.html	x_refsource_MISC x_transferred

Hyperlink: https://www.vmware.com/security/advisories/VMSA-2020-0023.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:security@vmware.com

Published At:20 Oct, 2020 | 17:15

Updated At:30 Oct, 2020 | 16:53

VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.7	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Primary	2.0	4.9	MEDIUM	AV:N/AC:M/Au:S/C:N/I:P/A:P

Type: Primary

Version: 3.1

Base score: 7.7

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.9

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:P

CPE Matches

VMware (Broadcom Inc.)

>>esxi>>7.0.0

cpe:2.3:o:vmware:esxi:7.0.0:-:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>7.0.0

cpe:2.3:o:vmware:esxi:7.0.0:1.20.16321839:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201806001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201807001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201808001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810231:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810232:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810233:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201810234:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201811001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201901001:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201901401:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201901402:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201901403:*:*:*:*:*:*

VMware (Broadcom Inc.)

>>esxi>>6.7

cpe:2.3:o:vmware:esxi:6.7:670-201903001:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-367	Primary	nvd@nist.gov
CWE-787	Primary	nvd@nist.gov

CWE ID: CWE-367

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.vmware.com/security/advisories/VMSA-2020-0023.html	security@vmware.com	Patch Vendor Advisory

Hyperlink: https://www.vmware.com/security/advisories/VMSA-2020-0023.html

Source: security@vmware.com

Resource:

Patch

Vendor Advisory

Similar CVEs

1358Records found

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.18% / 83.68%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-0.12% / 32.35%

||

7 Day CHG~0.00%

Published-15 Jul, 2022 | 15:48

Updated-23 Apr, 2025 | 17:58

Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows indesign macos InDesign

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.04%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.18% / 83.68%

||

7 Day CHG-0.01%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.69% / 81.49%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.36% / 57.27%

||

7 Day CHG~0.00%

Published-20 Sep, 2022 | 00:00

Updated-29 May, 2025 | 15:15

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.Fedora Project Debian GNU/Linux

Product-iphone_os fedora debian_linux safari ipados iOS and iPadOS Safari iOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-74.51% / 98.80%

||

7 Day CHG~0.00%

Published-25 Aug, 2016 | 21:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-06-14||Apply updates per vendor instructions.

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os n/a iOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.09% / 88.11%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-26.20% / 96.10%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.11% / 29.76%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 18:59

Updated-22 May, 2025 | 18:15

A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-tvos macos iphone_os ipados watchos watchOS tvOS macOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-44.74% / 97.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.35% / 56.67%

||

7 Day CHG+0.06%

Published-23 Sep, 2022 | 18:59

Updated-22 May, 2025 | 20:15

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-tvos macos iphone_os ipados watchos watchOS tvOS macOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.61% / 87.33%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.04%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.06% / 17.08%

||

7 Day CHG~0.00%

Published-20 Sep, 2022 | 00:00

Updated-30 Jul, 2025 | 01:37

Known KEV||Action Due Date - 2022-10-05||Apply updates per vendor instructions.

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

Vendor-Apple Inc.

Product-ipados iphone_os macos iOS macOS iOS, iPadOS, and macOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.68% / 88.92%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.13% / 88.18%

||

7 Day CHG+1.03%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.09% / 88.11%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.26% / 49.43%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x iphone_os watchos tvos n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-44.74% / 97.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.04%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.04%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.66% / 88.89%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.18% / 83.68%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.71% / 87.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.04%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.80% / 73.06%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.09% / 88.11%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 2.58%

||

7 Day CHG~0.00%

Published-08 Mar, 2024 | 01:36

Updated-13 Feb, 2025 | 17:34

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos macOS macos

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.19% / 86.47%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.19% / 86.47%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.13% / 88.18%

||

7 Day CHG+1.03%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Vendor-n/a Adobe Inc.openSUSE Linux Kernel Organization, Inc SUSE Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player enterprise_linux_server chrome_os linux_kernel linux_enterprise_workstation_extension opensuse flash_player_desktop_runtime enterprise_linux_desktop enterprise_linux_workstation linux_enterprise_desktop windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.61% / 87.33%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, and CVE-2016-4245.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Protect AI (formerly huntr.dev)

Matching Score-6

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-6.6||MEDIUM

EPSS-0.20% / 42.56%

||

7 Day CHG~0.00%

Published-21 Jan, 2022 | 00:00

Updated-15 Nov, 2024 | 13:08

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in vim/vim prior to 8.2.

Vendor-Vim Debian GNU/Linux Apple Inc.

Product-debian_linux macos vim vim/vim

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.27% / 50.11%

||

7 Day CHG+0.02%

Published-01 Nov, 2022 | 00:00

Updated-06 May, 2025 | 18:15

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos ipados iphone_os watchos macOS watchOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-0.75% / 72.22%

||

7 Day CHG~0.00%

Published-15 Feb, 2024 | 12:18

Updated-01 Aug, 2024 | 21:59

ZDI-CAN-22727: Adobe Acrobat Pro DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader acrobat_reader acrobat_reader_dc

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-0.17% / 38.67%

||

7 Day CHG~0.00%

Published-18 Mar, 2024 | 14:59

Updated-04 Dec, 2024 | 22:06

Adobe Premiere Pro Out-of-bounds Write Arbitrary code execution

Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-windows premiere_pro macos Premiere Pro premiere_pro

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.76% / 81.84%

||

7 Day CHG~0.00%

Published-18 Mar, 2024 | 15:54

Updated-04 Dec, 2024 | 22:03

Adobe Bridge 2024 Out of Bound Write Remote Code Execution Vulnerability

Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-windows bridge macos Bridge bridge

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-0.11% / 30.25%

||

7 Day CHG~0.00%

Published-10 Apr, 2024 | 13:02

Updated-05 Dec, 2024 | 15:00

Adobe Media Encoder 2024 AI file parsing Stack based buffer overflow

Media Encoder versions 24.2.1, 23.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-windows macos media_encoder Media Encoder media_encoder

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Protect AI (formerly huntr.dev)

Matching Score-6

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-8.4||HIGH

EPSS-1.68% / 81.45%

||

7 Day CHG~0.00%

Published-17 Feb, 2022 | 00:00

Updated-02 Aug, 2024 | 23:32

Stack-based Buffer Overflow in vim/vim

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Vendor-Vim Fedora Project Debian GNU/Linux Apple Inc.

Product-vim debian_linux macos fedora vim/vim

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-0.09% / 26.09%

||

7 Day CHG~0.00%

Published-18 Mar, 2024 | 14:59

Updated-04 Dec, 2024 | 22:07

ZDI-CAN-22671: Adobe Premiere Pro AVI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-windows premiere_pro macos Premiere Pro premiere_pro

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write