Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
结论预警: CVE-2016-1010 综合评估为严重在野威胁（94.3/100）：CVSS 技术影响为高级，利用概率偏高（EPSS 19.79%，百分位 97%） 核心证据: CISA 已知被利用漏洞目录（KEV）已于 2022-05-25 确认在野利用，影响 Adobe / Flash Player and AIR，弱点类型（CWE-190），攻击者可能未经认证远程获取高权限管理访问。 强制指令: CISA 处置窗口已过期，应按应急修补优先级立即处理。
风险随态势动态变化；本站持续评估并同步更新本页展示内容。
: Adobe Flash Player and AIR Integer Overflow Vulnerability · CISA KEV 详情
: 2022-05-25
: 2022-06-15
: The impacted products are end-of-life and should be disconnected if still in use.
EPSS 日更估计相对被利用可能性；百分位表示该 CVE 在已评分漏洞中的相对排名（越高表示相对更严重）。
| # | 日期 | 旧 EPSS 分数 | 新 EPSS 分数 | 变化（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-16 | 19.63% | 19.79% | +0.15% |
| 2 | 2026-06-15 | 12.70% | 19.63% | +6.93% |
| 3 | 2026-04-22 | — | 12.70% | — |
完整 EPSS 历史 （共 32 条）
该 CVE 的 CVSS 指标。
| 底座分 | 版本 | 严重度 | 向量 | 可利用性 | 影响 | 分数来源 |
|---|---|---|---|---|---|---|
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2016-1010: 1 GLSA(s) (201603-07), 1 atom(s) (www-plugins/adobe-flash); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2016-1010 |
redhat
|
critical | — | https://access.redhat.com/security/cve/CVE-2016-1010 |
ubuntu
|
medium | CVE-2016-1010 medium priority: Ubuntu including 2 source packages (adobe-flashplugin, flashplugin-nonfree), 8 status rows across 4 suites (precise, trusty, upstream, wily): released 7, needs-triage 1. | https://ubuntu.com/security/CVE-2016-1010 |
| 厂商 | 产品 | 版本 | 原始 CPE |
|---|---|---|---|
| adobe | flash_player | <= 20.0.0.306 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* |
| adobe | air | <= 20.0.0.233 | cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:* |
| adobe | air_sdk | <= 20.0.0.260 | cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:* |
| samsung | x14j_firmware | t-ms14jakucb-1102.5 | cpe:2.3:o:samsung:x14j_firmware:t-ms14jakucb-1102.5:*:*:*:*:*:*:* |
| adobe | flash_player | <= 11.2.202.569 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* |
| adobe | flash_player_desktop_runtime | <= 20.2.2.306 | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* |
| adobe | flash_player | <= 20.0.0.306 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* |
| adobe | flash_player | <= 20.0.0.306 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:* |
| adobe | air_desktop_runtime | <= 20.0.0.260 | cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:* |
| adobe | air_sdk_\&_compiler | <= 20.0.0.260 | cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:* |
| URL | 标签 |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/84308 | Broken Link Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1035251 | Broken Link Third Party Advisory VDB Entry |
| https://helpx.adobe.com/security/products/flash-player/apsb16-08.html | Patch Vendor Advisory |
| https://security.gentoo.org/glsa/201603-07 | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1010 | US Government Resource |