CVE-2015-3113KEV · OVERDUE

Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

High · published June 23, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

1632
days past CISA
deadline
CVSS v3.1
7.8
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

🚨 A heap-based buffer overflow in Adobe Flash Player means your system could be a playground for remote attackers! 🔥 Think of this as a waiter who serves food without checking the orders — a tiny slip could lead to the wrong dish (malicious code) being served to an unsuspecting customer (your system). An attacker could execute arbitrary code on your device, potentially gaining control over your system, stealing sensitive information, or wreaking havoc — all while you thought everything was fine. This exploit was even used in the wild back in June 2015, making it a serious threat!

Put simply

Think of this as a waiter who serves food without checking the orders — a tiny slip could lead to the wrong dish (malicious code) being served to an unsuspecting customer (your system). The vulnerability occurs due to improper handling of objects in memory, allowing attackers to overwrite sensitive data and execute malicious code remotely without authentication.

What to do

An attacker could execute arbitrary code on your device, potentially gaining control over your system, stealing sensitive information, or wreaking havoc — all while you thought everything was fine. This exploit was even used in the wild back in June 2015, making it a serious threat! Update Adobe Flash Player immediately to versions 13.0.0.296, 14.x through 18.x to version 18.0.0.194, or 11.2.202.468 for Linux. It's crucial to ensure your systems are no longer vulnerable to this sneaky exploit! You can tackle this! Act fast, implement the updates, and keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99812 · 100.0th percentile
Published
2015-06-23T21:00Z
KEV added
2022-04-13 · due 2022-05-04
EPSS history
Timeline
  • 13 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 23 JUN 21:00Z
    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux…
    cvelistv5