CVE-2016-7892 Adobe Flash Player Use-After-Free

Exploited in the wild High 8.8 Published 15 Dec 2016 Updated 21 Oct 2025

Attackers can execute arbitrary code via a use-after-free flaw in Adobe Flash Player's TextField class.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-7892?

CVE-2016-7892 is a high-severity use after free vulnerability in Adobe Flash Player, published on 15 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Weakness: CWE-416

Which versions are affected by CVE-2016-7892?

It affects 2 products.

Products include Adobe Flash Player, Adobe Flash Player Desktop Runtime.

How do I fix CVE-2016-7892?

Apply the vendor's patch. US federal agencies must fix it by 15 Apr 2022.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2016-7892 being exploited?

Yes. Attackers have exploited CVE-2016-7892 in the wild since at least 25 Mar 2022.

All Adobe Flash Player vulnerabilities

Sources

Also known as GHSA-gxjf-m829-568r.