Adobe will release a security update on April 7 to fix a critical vulnerability (CVE-2016-1019) in Adobe Flash Player 22.214.171.124. The vulnerability has been identified to be one that could “cause a crash and potentially allow an attacker to take control of an affected system,” and is known to be actively exploited in the wild.
According to the security advisory, the vulnerability affects Windows, Linux, Macintosh, and Chrome OS versions “being actively exploited on systems running Windows 10 and earlier with Flash Player version 126.96.36.1996 and earlier”. Users are urged to immediately update to the latest version of Flash Player that includes a mitigation introduced in the March 10 Flash Player 188.8.131.52 update—an update that will prevent attackers from exploiting the vulnerability.
Update: Adobe has released the security update that addresses the identified vulnerabilities, including CVE-2016-1019, which has been identified as a vulnerability used by the Magnitude Exploit Kit to spread Locky ransomware.