Adobe Flash Player
CVE-2015-5119
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconVictim navigates to malicious webpage
-
DeliveryBrowser loads embedded Flash content
-
ExploitMalicious SWF overrides ByteArray valueOf
-
InstallTriggers use-after-free in AS3 runtime
-
C2Memory corruption allows shellcode injection
-
ExecuteExecute arbitrary code in browser context
-
ImpactDeploy malware or establish persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Adobe Flash Player on any supported platform (Windows, OS X, Linux). Exploitation occurs through standard web browsing when Flash Player plugin is enabled (default installation state prior to 2016). Attack succeeds against any webpage embedding malicious Flash content, requiring no user clicks beyond initial page navigation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, elevated privileges, or non-default configurations required. Limiting factor: victim must use a browser with Flash Player plugin enabled and visit attacker-controlled or compromised website delivering the malicious .swf payload. |
| Impact | Exceptionally high real-world risk confirmed by convergent threat signals. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation against default configurations with no user interaction required. CISA KEV listing confirms active exploitation in July 2015, linked to the Hacking Team breach which leaked multiple weaponized Flash exploits. EPSS score of 93.21% (100th percentile) reflects widespread exploitation activity observed post-disclosure. Publicly available Metasploit module (exploit/multi/browser/adobe_flash_hacking_team_uaf) and PacketStorm POC demonstrate trivial reproducibility. US-CERT issued emergency alert TA15-195A specifically for this vulnerability. However, risk in 2025 is primarily archaeological - Flash Player reached end-of-life in December 2020 and is disabled in all major browsers. For organizations still running legacy Flash, this remains a critical unmitigated threat with proven exploit chains. The SSVC framework rates this as immediate priority during active support window due to confirmed exploitation, automatable attack, and total system compromise impact. |
| Exploit ScenarioDerived | Attacker hosts malicious Flash (.swf) content on compromised website or injects it into legitimate ad networks via malvertising. When victim browses to the page, the embedded Flash content automatically executes without user interaction (AV:N/UI:N), triggering the use-after-free by overriding ByteArray valueOf functions. This corrupts memory management, allowing the attacker to inject shellcode that executes with the victim's browser privileges, typically deploying second-stage malware or establishing remote access. Metasploit module demonstrates fully automated exploitation requiring only victim navigation to attacker-controlled URL. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 21, 2026
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitrary code via crafted Flash content exploiting a use-after-free flaw in the ByteArray class. Confirmed actively exploited (CISA KEV) in July 2015 following the Hacking Team data breach, which exposed weaponized exploit code targeting this vulnerability. With EPSS score of 93.21% (100th percentile) and publicly available proof-of-concept, this represents critical risk to unpatched Flash installations across Windows, OS X, and Linux platforms. Vendor-released patches available via Adobe APSB15-16.
Earlier versions of this analysis (1)
A use-after-free vulnerability in Flash Player's ActionScript 3 ByteArray class enables remote code execution. This exploit was discovered in the Hacking Team data breach (July 2015) and described as 'the most beautiful Flash bug for the last four years.'
RemediationAI
Upgrade Adobe Flash Player immediately to patched versions released in APSB15-16: version 18.0.0.203 for Windows/OS X extended support branch, 13.0.0.302 for ESR users, and 11.2.202.481 for Linux (details at https://helpx.adobe.com/security/products/flash-player/apsb15-16.html). Red Hat Enterprise Linux administrators should apply RHSA-2015-1214 via yum update flash-plugin. For systems unable to patch immediately, implement browser-based mitigations: disable Flash Player in browser settings (Chrome: chrome://settings/content/flash, Firefox: about:addons > Plugins), or configure click-to-play requiring user approval before Flash content executes. Network-level controls include blocking .swf file downloads at web proxies and deploying endpoint detection rules for ActionScript valueOf override patterns. Note that disabling Flash breaks legitimate content relying on the plugin; assess application dependencies before deployment. Given Flash's 2020 end-of-life, organizations should prioritize permanent removal over temporary mitigations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-416 (use-after-free) in the ActionScript 3 ByteArray class implementation within Adobe Flash Player's runtime engine. A use-after-free occurs when memory is accessed after being freed, typically by overriding JavaScript/ActionScript valueOf functions to trigger object destruction during ongoing operations. The flaw affects Flash Player's memory management in the AS3 virtual machine (AVM2), allowing attackers to manipulate freed memory regions and redirect program execution. CPE data identifies affected versions spanning Flash Player 11.x (Linux), 13.x-14.x (Windows/OS X), and 18.x branch prior to patches. The vulnerability also impacted Red Hat Enterprise Linux 5.0 and 6.0 systems shipping bundled Flash components. The ByteArray class is fundamental to Flash's binary data handling, making this a core runtime vulnerability rather than a peripheral feature flaw.
Know when Flash Player gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Executive ViewAI
CVE-2015-5119 is a critical remote code execution vulnerability in Adobe Flash Player affecting versions 11.x through 18.x, with confirmed active exploitation and publicly available weaponized exploit code. Any user viewing malicious Flash content on unpatched systems faces immediate compromise with no authentication required, creating organization-wide risk across Windows, macOS, and Linux endpoints.
Apply vendor patch APSB15-16 immediately. Interim mitigations pending patch deployment: disable Flash Player in all browsers via Group Policy or browser settings, block Flash content at network egress points using proxy/DLP, restrict access to untrusted websites, and isolate any legacy systems requiring Flash on air-gapped networks.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Flash Player
View allRemote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on L
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Window
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535