CVE-2016-1010 Adobe Flash Player and AIR Integer Overflow

Exploited in the wild High 8.8 Published 12 Mar 2016 Updated 21 Oct 2025

Attackers can execute arbitrary code via an integer overflow in Adobe Flash Player, requiring users to upgrade to patched versions.

Exploited in the wild: Since 25 May 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-1010?

CVE-2016-1010 is a high-severity vulnerability in Adobe Air, published on 12 Mar 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

Weakness: CWE-190

Which versions are affected by CVE-2016-1010?

It affects 7 products.

Products include Adobe Air, Adobe Air Desktop Runtime, Adobe Air Sdk, Adobe Air Sdk \& Compiler, Adobe Flash Player, Adobe Flash Player Desktop Runtime and 1 more.

How do I fix CVE-2016-1010?

Upgrade to a fixed version. US federal agencies must fix it by 15 Jun 2022.

Is CVE-2016-1010 being exploited?

Yes. Attackers have exploited CVE-2016-1010 in the wild since at least 25 May 2022.

All Adobe Air vulnerabilities

Sources

Also known as GHSA-rf44-cp45-ppcv, UBUNTU-CVE-2016-1010.