CVE-2016-4278

Vulnerability

Adobe Flash Player contains an information disclosure vulnerability (CVE-2016-4278) that allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors [1]. Affected versions include Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X, and before 11.2.202.635 on Linux [2].

Exploitation

An attacker can trigger this vulnerability by convincing a user to open a specially crafted Flash file (e.g., via a malicious webpage or email attachment). The exact mechanism is not publicly detailed, but it allows unauthorized access to sensitive data [1][2].

Impact

Successful exploitation leads to the disclosure of sensitive information from the user's system or browser session, potentially revealing credentials, personal data, or other confidential content [2]. The attacker does not gain code execution from this specific CVE, but information can be exfiltrated to a remote server.

Mitigation

Adobe released updated versions: Flash Player 23.0.0.162 (Windows/OS X), Flash Player 11.2.202.635 (Linux), and Flash Player 18.0.0.375 bundled with some browsers. Users and administrators should update immediately patched versions as no workaround is available [1][2]. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.