CVE-2016-7892

An unpatched use-after-free vulnerability in Adobe Flash Player allowed remote code execution, exploited in the wild after Flash reached end-of-life in 2020.

Adobe Flash Player's use-after-free vulnerability in the TextField class enabled remote code execution, and because Flash reached end-of-life in December 2020, no patches were issued, leaving installations perpetually vulnerable. DIB organizations must ensure Flash is completely removed from all systems, as any remaining instances represent a perpetual security liability with no path to remediation.

Shame score — Adobe failed to patch a critical vulnerability in a product that had already reached end-of-life, and the vulnerability was actively exploited in the wild, demonstrating severe negligence in maintaining a discontinued product.