CVE-2016-4137

HIGH

Adobe Flash Player <=21.0.0.242 - Third Exploit-Referenced Impact Unknown

Title source: manual

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-4137. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit targets a heap corruption vulnerability in Adobe Flash Player due to improper handling of LMZA property decoding in image files. The PoC involves loading a maliciously crafted image file via a SWF, which can lead to arbitrary code execution.

Description

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdosmultiple

https://www.exploit-db.com/exploits/40089

View Code ZIP pw:eip

This exploit targets a heap corruption vulnerability in Adobe Flash Player due to improper handling of LMZA property decoding in image files. The PoC involves loading a maliciously crafted image file via a SWF, which can lead to arbitrary code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Racy

Target: Adobe Flash Player (versions prior to fix for CVE-2016-4137)

No auth needed

Prerequisites: Victim must load the malicious SWF file with the crafted image

MITRE ATT&CK