CVE-2015-3043KEV · OVERDUE

Adobe Flash Player Memory Corruption Vulnerability

High · published April 14, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
7.8
EPSS
74%
Percentile
99.5
In the wild
Confirmed
What it is

⚡ Adobe Flash Player has a nasty bug that lets attackers execute arbitrary code, no special tricks required — just like a chef who can use any ingredient to whip up a surprise dish! 🔥 Think of this vulnerability like a restaurant that allows anyone to enter the kitchen without any checks. Once inside, a mischievous chef could mix up the ingredients, serve a contaminated dish, or even poison the entire menu! If exploited, an attacker could run any code they want on your system, potentially leading to data theft or a complete crash of your service. It’s absolutely devastating—this could compromise everything on your device!

Put simply

Think of this vulnerability like a restaurant that allows anyone to enter the kitchen without any checks. Once inside, a mischievous chef could mix up the ingredients, serve a contaminated dish, or even poison the entire menu! This flaw in Adobe Flash Player (versions before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X, and before 11.2.202.457 on Linux) allows for memory corruption, enabling attackers to execute arbitrary code.

What to do

If exploited, an attacker could run any code they want on your system, potentially leading to data theft or a complete crash of your service. It’s absolutely devastating—this could compromise everything on your device! Update your Adobe Flash Player immediately to version 17.0.0.169 or later for Windows and OS X, and 11.2.202.457 or later for Linux. Don't wait—this vulnerability has been exploited, so patching is critical! You've got this! Implement these updates and keep your systems safe and secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.73862 · 99.5th percentile
Published
2015-04-14T22:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 14 APR 22:00Z
    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute…
    cvelistv5