CVE-2021-42721 | ByteOS Network

Vulnerability Details :

CVE-2021-42721

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-16 Nov, 2021 | 20:02

Updated At-17 Sep, 2024 | 01:16

Adobe Bridge Use After Free could lead to Arbitrary code execution

Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:16 Nov, 2021 | 20:02

Updated At:17 Sep, 2024 | 01:16

▼CVE Numbering Authority (CNA)

Adobe Bridge Use After Free could lead to Arbitrary code execution

Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected Products

Vendor

Product

Versions

Affected

From unspecified through 11.1.1 (custom)
From unspecified through None (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-416	Use After Free (CWE-416)

Type: CWE

CWE ID: CWE-416

Description: Use After Free (CWE-416)

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/bridge/apsb21-94.html	x_refsource_MISC

Hyperlink: https://helpx.adobe.com/security/products/bridge/apsb21-94.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/bridge/apsb21-94.html	x_refsource_MISC x_transferred

Hyperlink: https://helpx.adobe.com/security/products/bridge/apsb21-94.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@adobe.com

Published At:16 Nov, 2021 | 21:15

Updated At:15 Apr, 2022 | 15:23

Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

>>media_encoder>>Versions up to 15.4(inclusive)

cpe:2.3:a:adobe:media_encoder:*:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-416	Primary	nvd@nist.gov
CWE-416	Secondary	psirt@adobe.com

CWE ID: CWE-416

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-416

Type: Secondary

Source: psirt@adobe.com

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/bridge/apsb21-94.html	psirt@adobe.com	Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/bridge/apsb21-94.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Similar CVEs

6971Records found

Matching Score-10

Assigner-Talos

Matching Score-10

Assigner-Talos

CVSS Score-8||HIGH

EPSS-15.92% / 94.49%

||

7 Day CHG~0.00%

Published-03 Oct, 2018 | 15:00

Updated-16 Sep, 2024 | 22:36

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows Foxit PDF Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.93% / 85.90%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Talos

Matching Score-10

Assigner-Talos

CVSS Score-8||HIGH

EPSS-0.22% / 44.62%

||

7 Day CHG~0.00%

Published-02 Oct, 2018 | 21:00

Updated-17 Sep, 2024 | 03:55

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Subject property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows Foxit PDF Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.55% / 88.76%

||

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1017.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.93% / 85.90%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-55.40% / 97.98%

||

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-10.51% / 92.96%

||

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.93% / 85.90%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-0.07% / 21.41%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 16:58

Updated-23 Aug, 2025 | 00:40

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Vendor-Microsoft Corporation

Product-365_apps office_long_term_servicing_channel office word Microsoft Office LTSC 2024 Microsoft 365 Apps for Enterprise Microsoft Office 2019 Microsoft Word 2016 Microsoft Office LTSC 2021

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.33% / 84.20%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.16% / 83.61%

||

7 Day CHG~0.00%

Published-12 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-50.07% / 97.74%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-46.55% / 97.58%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-11.66% / 93.41%

||

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0984.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-46.40% / 97.57%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-6.53% / 90.75%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.73% / 90.11%

||

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via a URLLoader.load call, a different vulnerability than CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-7.21% / 91.24%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.16% / 83.61%

||

7 Day CHG~0.00%

Published-12 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-7.76% / 91.60%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-9.36% / 92.46%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.51% / 92.02%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.46% / 87.08%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-46.40% / 97.57%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.73% / 90.11%

||

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code by leveraging improper reference handling, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.38% / 84.36%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.43% / 89.79%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-6.53% / 90.75%

||

7 Day CHG~0.00%

Published-12 Mar, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Vendor-n/a Samsung Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os linux_kernel flash_player_desktop_runtime air_desktop_runtime air_sdk x14j_firmware air_sdk_\&_compiler windows_8.1 windows iphone_os mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-67.59% / 98.51%

||

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-06-15||The impacted products are end-of-life and should be disconnected if still in use.

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

Vendor-n/a Linux Kernel Organization, Inc Microsoft Corporation Google LLC Adobe Inc.Apple Inc.

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a Flash Player and AIR

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-72.97% / 98.73%

||

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 81.80%

||

7 Day CHG~0.00%

Published-04 Mar, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8822.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os windows_8 linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 81.80%

||

7 Day CHG~0.00%

Published-04 Mar, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os windows_8 linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 81.80%

||

7 Day CHG~0.00%

Published-04 Mar, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8821, and CVE-2015-8822.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os windows_8 linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-0.98% / 75.80%

||

7 Day CHG~0.00%

Published-04 Mar, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8821.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player chrome_os windows_8 linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-56.21% / 98.02%

||

7 Day CHG~0.00%

Published-19 Aug, 2020 | 00:00

Updated-05 May, 2025 | 17:16

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-macos acrobat_reader_dc windows acrobat_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-4.71% / 88.95%

||

7 Day CHG~0.00%

Published-19 Aug, 2020 | 14:14

Updated-04 Aug, 2024 | 10:43

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-0.84% / 73.83%

||

7 Day CHG~0.00%

Published-22 Apr, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted text property, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-windows_8.0 flash_player air chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Zero Day Initiative

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-7.8||HIGH

EPSS-1.93% / 82.66%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 22:20

Updated-04 Aug, 2024 | 10:12

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows PhantomPDF

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-4.10% / 88.15%

||

7 Day CHG~0.00%

Published-25 Jun, 2020 | 21:22

Updated-04 Aug, 2024 | 10:34

Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.83% / 85.65%

||

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:09

Updated-05 May, 2025 | 17:16

Adobe Bridge versions 10.0.1 and earlier version have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Microsoft Corporation Adobe Inc.

Product-bridge windows Adobe Bridge

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Zero Day Initiative

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-7.8||HIGH

EPSS-16.39% / 94.61%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 22:20

Updated-04 Aug, 2024 | 10:12

This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows PhantomPDF

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Zero Day Initiative

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-7.8||HIGH

EPSS-1.23% / 78.36%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 22:20

Updated-04 Aug, 2024 | 10:12

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862.

Vendor-Microsoft Corporation Foxit Software Incorporated

Product-phantompdf reader windows Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-1.02% / 76.32%

||

7 Day CHG~0.00%

Published-09 May, 2023 | 17:03

Updated-10 Jul, 2025 | 16:38

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Excel Remote Code Execution Vulnerability

Vendor-Microsoft Corporation

Product-office_long_term_servicing_channel office_online_server office excel 365_apps Microsoft Excel 2016 Microsoft 365 Apps for Enterprise Microsoft Office LTSC for Mac 2021 Microsoft Office Online Server Microsoft Office 2019 Microsoft Office LTSC 2021 Microsoft Excel 2013 Service Pack 1 Microsoft Office 2019 for Mac

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-KrCERT/CC

Matching Score-10

Assigner-KrCERT/CC

CVSS Score-7.8||HIGH

EPSS-0.68% / 70.66%

||

7 Day CHG~0.00%

Published-30 Jul, 2020 | 13:22

Updated-04 Aug, 2024 | 09:41

DaviewIndy Use-After-Free Vulnerability

DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.

Vendor-hmtalk HumanTalk Microsoft Corporation

Product-windows daviewindy DavieIndy

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.38% / 84.40%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.77% / 81.90%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.76% / 81.84%

||

7 Day CHG~0.00%

Published-12 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:45

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.93% / 85.90%

||

7 Day CHG~0.00%

Published-18 Jan, 2019 | 17:00

Updated-05 Aug, 2024 | 10:10

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.68% / 81.45%

||

7 Day CHG~0.00%

Published-12 Oct, 2018 | 18:00

Updated-05 Aug, 2024 | 08:45

Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.20% / 88.30%

||

7 Day CHG~0.00%

Published-20 Jul, 2018 | 19:00

Updated-05 Aug, 2024 | 08:45

Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions

CWE ID-CWE-416

Use After Free