CVE-2016-4117

Q: What is the severity of CVE-2016-4117?

CVE-2016-4117 has a CVSS score of 9.8 (CRITICAL). CVE-2016-4117 is a critical remote code execution vulnerability in Adobe Flash Player that allows attackers to execute arbitrary code on vulnerable systems. It affects Flash Player 21.0.0.226 and earlier versions across all supported platforms. This vulnerability was actively exploited in the wild in May 2016.

9.8 CRITICAL

Remote Code Execution

📋 TL;DR

CVE-2016-4117 is a critical remote code execution vulnerability in Adobe Flash Player that allows attackers to execute arbitrary code on vulnerable systems. It affects Flash Player 21.0.0.226 and earlier versions across all supported platforms. This vulnerability was actively exploited in the wild in May 2016.

💻 Affected Systems

Products:

Adobe Flash Player

Versions: 21.0.0.226 and earlier

Operating Systems: Windows, macOS, Linux, Chrome OS

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all browsers with Flash Player plugin enabled. Chrome's built-in Flash (PPAPI) is also vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control over the victim's computer, enabling data theft, ransomware deployment, or persistent backdoor installation.

🟠

Likely Case

Malware installation leading to credential theft, data exfiltration, or system integration into botnets.

🟢

If Mitigated

No impact if Flash Player is disabled, blocked, or fully patched.

🌐 Internet-Facing: HIGH - Exploitable through web browsers when visiting malicious sites or viewing malicious content.

🏢 Internal Only: MEDIUM - Exploitable through internal web applications or email attachments containing Flash content.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Actively exploited in the wild via drive-by downloads and malicious Flash content. Exploit kits like Angler and Neutrino incorporated this vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 21.0.0.242 or later

Vendor Advisory: https://helpx.adobe.com/security/products/flash-player/apsa16-03.html

Restart Required: Yes

Instructions:

1. Update Adobe Flash Player to version 21.0.0.242 or later. 2. For Chrome users, update Chrome to version 50.0.2661.102 or later. 3. Restart browser after update.

🔧 Temporary Workarounds

Disable Flash Player

all

Completely disable Adobe Flash Player in all browsers

Browser-specific: Set Flash to 'Block sites from running Flash' or 'Ask first'

Use Click-to-Play

all

Configure browsers to require user permission before running Flash content

Chrome: chrome://settings/content/flash → 'Block sites from running Flash'
Firefox: about:addons → Plugins → Shockwave Flash → 'Ask to Activate'

🧯 If You Can't Patch

Block Flash content at network perimeter using web proxy or firewall
Implement application whitelisting to prevent unauthorized Flash execution

🔍 How to Verify

Check if Vulnerable:

Visit https://helpx.adobe.com/flash-player.html and click 'Check Now' or check browser plugin version

Check Version:

Windows: reg query "HKLM\SOFTWARE\Macromedia\FlashPlayer" /v Version | Linux: dpkg -l | grep flashplugin-nonfree | Windows PowerShell: Get-ItemProperty -Path "HKLM:\SOFTWARE\Macromedia\FlashPlayer" -Name Version

Verify Fix Applied:

Verify Flash Player version is 21.0.0.242 or later

📡 Detection & Monitoring

Log Indicators:

Browser crash logs with Flash Player module
Windows Event Logs with Application Error for Flash*.ocx or Flash*.dll
Antivirus alerts for Flash-related exploits

Network Indicators:

HTTP requests to known exploit kit domains from May 2016
Unusual outbound connections following Flash content loading

SIEM Query:

source="*browser*" AND (event="crash" AND process="*flash*") OR (url="*swf" AND status=200 AND size>1000000)

📊 Metadata

CVE ID: CVE-2016-4117

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published: May 11, 2016

Last Updated: November 17, 2025

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html Mailing List,Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1079.html Third Party Advisory
http://www.securityfocus.com/bid/90505 Broken Link,Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1035826 Broken Link,Third Party Advisory,VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Broken Link,Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-15.html Broken Link
https://security.gentoo.org/glsa/201606-08 Third Party Advisory
https://www.exploit-db.com/exploits/46339/ Exploit,Third Party Advisory,VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html Mailing List,Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1079.html Third Party Advisory
http://www.securityfocus.com/bid/90505 Broken Link,Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1035826 Broken Link,Third Party Advisory,VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Broken Link,Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-15.html Broken Link
https://security.gentoo.org/glsa/201606-08 Third Party Advisory
https://www.exploit-db.com/exploits/46339/ Exploit,Third Party Advisory,VDB Entry
https://github.com/cisagov/vulnrichment/issues/196
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117