Skip to content
brandefense.io
Request A Demo
WatchlistHigh

CVE-2016-0974Air Sdk Use-After-Free

flash-plugin: multiple code execution issues fixed in APSB16-04

Published Feb 9, 2016 · Updated Feb 4, 2026 · Also known as UBUNTU-CVE-2016-0974

Key Facts

Patch immediately
  • CVE-2016-0974 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Air Desktop Runtime (Adobe), Air Sdk (Adobe), Air Sdk \& Compiler (Adobe) and 6 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 31% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Air Desktop Runtime 20.0.0.233, Air Sdk 20.0.0.233, Air Sdk \& Compiler 20.0.0.233.
  • Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

31%

Higher than 98.2% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

47/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

2

Proof-of-concept links

In-the-wild evidence

0

Reports of active use

Advisories And Exploit References

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

Affected Products

34 affected entries in total
ProductAffected versionsFixed in
Air Desktop RuntimeAdobeSee advisory20.0.0.233
Air SdkAdobeSee advisory20.0.0.233
Air Sdk \& CompilerAdobeSee advisory20.0.0.233
Flash PlayerAdobeSee advisory11.2.202.559
Flash Player Desktop RuntimeAdobeSee advisory20.0.0.286
4 more affected products in the full CVE brief

Patched Releases

Air Desktop Runtime

20.0.0.233

Air Sdk

20.0.0.233

Air Sdk \& Compiler

20.0.0.233

Flash Player

11.2.202.559, 18.0.0.326, 20.0.0.272, 20.0.0.286, 11.2.202.569-0.35.1, 11.2.202.569-120.1, 11.2.202.569-153.1, 11.2.202.569-2.88.1

Flash Player Desktop Runtime

20.0.0.286

flash-player-gnome

11.2.202.569-0.35.1, 11.2.202.569-120.1, 11.2.202.569-153.1, 11.2.202.569-2.88.1

flash-player-kde4

11.2.202.569-0.35.1, 11.2.202.569-153.1, 11.2.202.569-2.88.1

flash-plugin

0:11.2.202.569-1.el5, 0:11.2.202.569-1.el6_7

flashplugin-nonfree

11.2.202.569ubuntu0.14.04.1

Timeline

  1. Publicly disclosed

    Feb 9, 2016

  2. Last updated

    Feb 4, 2026

Weakness Type

  • CWE-416 Use After Free

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2016-0974 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.