What is the CVSS score of CVE-2015-8651?

CVE-2015-8651 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 89.0%.

Which versions of Adobe Flash Player are affected by CVE-2015-8651?

Adobe Flash Player versions before 18.0.0.324 and 20.0.0.267 contain a remote code execution vulnerability confirmed actively exploited by adversaries, enabling attackers to execute arbitrary code on…. A patch is available.

Is CVE-2015-8651 being actively exploited?

Yes, CVE-2015-8651 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2015-8651?

Within 24 hours: identify all systems running Adobe Flash Player using endpoint discovery tools and isolate or air-gap critical systems if patching cannot be completed immediately. Within 7 days: deploy vendor patches to Flash Player 18.0.0.324 or later (Windows/OS X/Linux), Adobe AIR 20.0.0.233 or later, and associated SDKs; verify installation via version checks. Within 30 days: complete organization-wide inventory of Flash dependencies, decommission Flash where operationally feasible, and transition to modern alternatives (HTML5, PPAPI-based solutions); document any legacy systems requiring Flash with executive exception and apply additional compensating controls.

Adobe Flash Player CVE-2015-8651

HIGH

Integer Overflow or Wraparound (CWE-190)

2015-12-28 psirt@adobe.com

RCE Integer Overflow Microsoft Adobe Red Hat HP Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Workstation Linux Enterprise Desktop Suse Flash Player Version Control Repository Manager Systems Insight Manager System Management Homepage Opensuse Air Air Sdk Air Sdk Compiler Linux Enterprise Workstation Extension Evergreen Insight Control Matrix Operating Environment Insight Control Server Provisioning

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 22, 2026 - 12:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

Patch released

Oct 22, 2025 - 00:15 nvd

Patch available

CVE Published

Dec 28, 2015 - 23:59 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

AnalysisAI

Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.

Technical ContextAI

This vulnerability stems from an integer overflow (CWE-190) in Adobe Flash Player's ActionScript Virtual Machine (AVM2) runtime engine. Integer overflows occur when arithmetic operations produce values exceeding the maximum size of the integer type, causing wraparound to small or negative values. In Flash Player, this typically manifests during memory allocation calculations where an overflowed size value leads to undersized buffer allocation. Subsequent operations writing expected amounts of data into the undersized buffer trigger heap corruption, enabling attackers to achieve memory manipulation and ultimately arbitrary code execution. The vulnerability affects the core Flash Player runtime across all major desktop platforms, plus the AIR runtime environment used for standalone Flash applications and the corresponding SDKs used by developers.

RemediationAI

Immediately upgrade to Adobe Flash Player 18.0.0.324 or later for older branches, 20.0.0.267 or later for current branches on Windows/OS X, or 11.2.202.559 or later on Linux. Upgrade Adobe AIR runtime and all SDKs to version 20.0.0.233 or later per APSB16-01. For Red Hat Enterprise Linux environments, apply RHSA-2015-2697 via yum/dnf package managers. Organizations unable to patch immediately should disable Flash Player browser plugins, implement browser-based Flash click-to-play restrictions, and block Flash content at web proxies until patching completes. Note that disabling Flash will break legacy web applications dependent on Flash functionality-catalog these dependencies before implementing controls. Long-term, migrate all Flash-dependent applications to HTML5 or modern alternatives, as Adobe ended Flash Player support in December 2020.