High 7.8Known exploited (CISA KEV)Published Apr 7, 2016

CVE-2016-1019Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild…

Updated under an hour ago (Oct 26, 2026, 3:10 PM ET)

Does this affect you?

It affects adobe flash_player_desktop_runtime and 4 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Mar 3, 2022; federal agencies had to remediate by Mar 24, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for adobe flash_player_desktop_runtime

Exploited in the last 30 days

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

CVSS: 7.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Added to CISA KEV Mar 3, 2022; federal remediation due Mar 24, 2022; known ransomware useThe impacted product is end-of-life and should be disconnected if still in use.
EPSS (exploitation in the next 30 days): 22.32% (percentile 98)
Assigned by: adobe
NVD analysis: Analyzed
Record last updated: Oct 1, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

adobe flash_player_desktop_runtime adobe:flash_player_desktop_runtime	through 21.0.0.197	NVD
adobe flash_player adobe:flash_player	through 18.0.0.333; through 21.0.0.197; through 21.0.0.197; through 21.0.0.197; through 11.2.202.577	NVD
adobe air_desktop_runtime adobe:air_desktop_runtime	through 21.0.0.176	NVD
adobe air_sdk adobe:air_sdk	through 21.0.0.176	NVD
adobe air_sdk_&_compiler adobe:air_sdk_&_compiler	through 21.0.0.176	NVD

References

References

https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html	x-refsource-misc, broken-link
https://security.gentoo.org/glsa/201606-08	vendor-advisory, x-refsource-gentoo, third-party-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html	vendor-advisory, x-refsource-suse, broken-link
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html	x-refsource-confirm, vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html	vendor-advisory, x-refsource-suse, broken-link
http://www.securitytracker.com/id/1035491	vdb-entry, x-refsource-sectrack, broken-link, third-party-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	vendor-advisory, x-refsource-suse, broken-link
http://blogs.adobe.com/psirt/?p=1330	x-refsource-confirm, broken-link, vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html	vendor-advisory, x-refsource-suse, broken-link
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	vendor-advisory, x-refsource-suse, broken-link
1–10 of 17

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.