CVE-2016-1096

HIGH

Adobe Flash Player <=21.0.0.213 in IE/Edge - Impact Unknown

Title source: manual

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1096. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a stack corruption vulnerability in Adobe Flash Player when processing a maliciously crafted MP4 file. The PoC requires hosting a SWF file and an MP4 file on a server, which when loaded, triggers the vulnerability.

Description

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdosmultiple

https://www.exploit-db.com/exploits/39828

View Code ZIP pw:eip

This exploit leverages a stack corruption vulnerability in Adobe Flash Player when processing a maliciously crafted MP4 file. The PoC requires hosting a SWF file and an MP4 file on a server, which when loaded, triggers the vulnerability.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Adobe Flash Player (versions affected by CVE-2016-1096)

No auth needed

Prerequisites: Hosting environment for SWF and MP4 files · Victim interaction to load the malicious SWF

MITRE ATT&CK