CVE-2015-5134

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe…

published August 14, 2015

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 98.9th percentile for exploit probability.

CVSS
—
EPSS
50%
Percentile
98.9
In the wild
Unconfirmed
What it is

🚨 A crafty code execution vulnerability lurks in Adobe Flash Player and Adobe AIR, just waiting for an unsuspecting click! ⚠️ Think of this vulnerability like an expired train ticket that still lets you through the gates — it’s no longer valid, but somehow, it still works, allowing unwanted access! An attacker could exploit this to run arbitrary code on a user’s machine, potentially causing catastrophic damage like data theft, system compromise, or even complete control of the affected system. This type of vulnerability is absolutely devastating, especially in environments that rely on Flash for critical applications.

Put simply

Think of this vulnerability like an expired train ticket that still lets you through the gates — it’s no longer valid, but somehow, it still works, allowing unwanted access! This use-after-free flaw occurs when Adobe Flash Player or AIR fail to properly manage memory, allowing attackers to execute malicious code through unspecified vectors, which could lead to a full system breach.

What to do

An attacker could exploit this to run arbitrary code on a user’s machine, potentially causing catastrophic damage like data theft, system compromise, or even complete control of the affected system. This type of vulnerability is absolutely devastating, especially in environments that rely on Flash for critical applications. To safeguard against this, update Adobe Flash Player to version 18.0.0.232 or newer, and ensure Adobe AIR is updated to at least version 18.0.0.199. If you're still using older versions, it's time to patch up and protect your system! You've got this! Take these steps, and you'll be one step closer to being a security superhero! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.50286 · 98.9th percentile
Published
2015-08-14T01:00Z
EPSS history
Timeline
  • 14 AUG 01:00Z
    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe…
    cvelistv5