CVE-2015-0313KEV · OVERDUE

Adobe Flash Player Use-After-Free Vulnerability

High · published February 2, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1633
days past CISA
deadline
CVSS v3.1
7.8
EPSS
95%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A sneaky use-after-free vulnerability in Adobe Flash Player can let remote attackers execute arbitrary code! ⚡ Think of this like an overly trusting waiter who keeps serving food even after you've left the restaurant — if they’re not careful, someone could take your unfinished meal and do whatever they want with it! An attacker could exploit this vulnerability to gain full control over your system and execute any code they desire, which means they could steal personal data, install malware, or wreak havoc on your files — a full-on digital disaster!

Put simply

Think of this like an overly trusting waiter who keeps serving food even after you've left the restaurant — if they’re not careful, someone could take your unfinished meal and do whatever they want with it! This use-after-free flaw occurs when Adobe Flash Player attempts to access memory that has already been freed, allowing attackers to manipulate the execution flow and inject malicious code.

What to do

An attacker could exploit this vulnerability to gain full control over your system and execute any code they desire, which means they could steal personal data, install malware, or wreak havoc on your files — a full-on digital disaster! To protect yourself, update Adobe Flash Player to the latest version. Specifically, ensure you’re on version 13.0.0.269 or 14.x to 16.x on Windows and OS X, or 11.2.202.442 on Linux. Stay safe by regularly checking for updates and applying them promptly! You've got this! With these updates, you’ll keep your systems secure and show those vulnerabilities who's boss! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.95266 · 99.9th percentile
Published
2015-02-02T19:00Z
KEV added
2022-04-13 · due 2022-05-04
EPSS history
Timeline
  • 13 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 02 FEB 19:00Z
    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on…
    cvelistv5