{"id":"CVE-2016-4117","published":"2016-05-11T01:59:46Z","modified":"2026-09-10T04:17:30Z","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":{"product":"Adobe Flash Player","since":"2020-12-31","note":"No security updates; remove it."},"description":{"text":"Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player, in versions 21.0.0.226 and earlier, contains an arbitrary code execution flaw whose specific vector is not disclosed. A remote attacker can exploit it to run arbitrary code with no authentication or user interaction required and no special configuration needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:14Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.94271,"percentile":0.9985,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-4117","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-05-08","exploitedFirstSeen":"2016-05-08","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-05-08"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4117","date":"2016-05-11"},{"url":"https://security.berkeley.edu/news/vulnerable-adobe-flash-player-allows-remote-code-execution-cve-2016-4117","date":"2016-05-24"},{"url":"https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/","date":"2016-06-14"},{"url":"https://securelist.com/operation-daybreak/75100/","date":"2016-06-17"},{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://unit42.paloaltonetworks.com/unit42-dealerschoice-sofacys-flash-player-exploit-platform/","date":"2016-10-17"},{"url":"https://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/","date":"2016-12-06"},{"url":"https://www.microsoft.com/security/blog/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/?source=mmpc","date":"2016-12-14"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/terror-exploit-kit-more-like-error-exploit-kit/","date":"2017-01-09"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Nov 1, 2026","url":"https://otx.alienvault.com/pulse/6ae6007740c10de9f3c0173d","created":"2026-10-31"},{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1079.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/90505","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035826","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa16-02.html","tags":["Broken Link","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-15.html","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/201606-08","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46339/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1079.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/90505","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035826","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa16-02.html","tags":["Broken Link","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-15.html","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/201606-08","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46339/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-3d89b3537203eabaf47a","title":"RATANKBA: Delving into Large-scale Watering Holes","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html","date":"2017-02-27","mentions":[{"quote":"While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.","start":7137,"end":7330}]},{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2018-4878 (Zero-day vulnerability)\r\nCVE-2017-0199\r\nCVE-2015-2387\r\nCVE-2015-2545\r\nCVE-2015-7645\r\nCVE-2016-4117","start":7012,"end":7332},{"quote":"CVE-2016-4117, CVE-","start":8045,"end":8064},{"quote":"CVE-2016-4117","start":9118,"end":9131}]},{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"early May that made use of an exploit for CVE-2016-4117, a vulnerability in","start":49161,"end":49236},{"quote":"exact same CVE-2016-4117 exploit code that PROMETHIUM used, prior to public","start":52589,"end":52664},{"quote":"background, a series of events, including the use of the CVE-2016-4117 zero-day","start":53974,"end":54053},{"quote":"The NEODYMIUM attack chain shows how the exploit CVE-2016-4117 was used to infect target individuals’ computers","start":54518,"end":54629},{"quote":"The Flash vulnerability CVE-2016-4117 is a type","start":61621,"end":61668}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-5118","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-5118","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":46339,"url":"https://www.exploit-db.com/exploits/46339","title":"Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)","type":"remote","platform":"osx","date":"2019-02-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-02-11"},"pocGithub":{"count":1,"skipped":0,"earliest":"2017-02-23","earliestUrl":"https://github.com/amit-raut/CVE-2016-4117-Report","repos":[{"name":"amit-raut/CVE-2016-4117-Report","url":"https://github.com/amit-raut/CVE-2016-4117-Report","stars":1,"created":"2017-02-23"}]},"metasploit":[{"name":"Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion","module":"exploit/osx/browser/adobe_flash_delete_range_tl_op","type":"exploit","disclosureDate":"2016-04-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/adobe_flash_delete_range_tl_op.rb"}],"first":{"date":"2016-04-27","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/adobe_flash_delete_range_tl_op.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46339/"],"flow":[{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"related","techniques":["T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-04-27","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2017-02-23, Exploit-DB 2019-02-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/adobe_flash_delete_range_tl_op.rb","provenance":"source"},{"date":"2016-05-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2016-05-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4117","provenance":"source"},{"date":"2017-02-27","kind":"report","label":"Named in trendmicro.com: RATANKBA: Delving into Large-scale Watering Holes","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html","provenance":"machine"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-5118","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2122},"priority":{"score":72.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3829 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]}}