CVE-2016-1010

Name: CVE-2016-1010
Creator: NVD / NIST
Published: 2016-03-12T15:59:25.09+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10Actively ExploitedEPSS 19.79%

Last modified Jun 17, 2026

CVE-2016-1010 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.. CISA has confirmed active exploitation in the wild. EPSS estimates a 19.79% chance of exploitation in the next 30 days.

Description

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

19.79%

97.1th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Jun 15, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Adobe	Flash Player	<= 20.0.0.306
Adobe	Air	<= 20.0.0.233
Adobe	Air Sdk	<= 20.0.0.260
Samsung	X14j Firmware	t-ms14jakucb-1102.5
Adobe	Flash Player	<= 11.2.202.569
Adobe	Flash Player Desktop Runtime	<= 20.2.2.306
Adobe	Air Desktop Runtime	<= 20.0.0.260
Adobe	Air Sdk \& Compiler	<= 20.0.0.260

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/84308Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035251Broken Link, Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb16-08.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201603-07Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/84308Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035251Broken Link, Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb16-08.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201603-07Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1010US Government Resource

Timeline

Published: Mar 12, 2016
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2016-1010?

How severe is CVE-2016-1010?

CVE-2016-1010 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 19.79% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2016-1010?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-1010?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST