CVE-2016-0984

Adobe Flash Player and AIR contained a use-after-free vulnerability allowing remote code execution, which was actively exploited in the wild.

The use-after-free flaw in Adobe Flash Player and AIR enabled attackers to execute arbitrary code remotely. Because Flash reached end-of-life in December 2020 without further patches, any remaining installations remain perpetually vulnerable to unpatched exploits, representing a severe compliance and security liability for organizations still supporting legacy systems.

Shame score — Adobe shipped a product with a critical remote code execution flaw that was actively exploited in the wild, and the vendor discontinued the product without ensuring a secure transition, leaving organizations with a perpetual security liability.