Vulnerability record · CVE-2015-0310 · published 23 January 2015
CVE-2015-0310: Adobe Flash Player ASLR bypass via memory address disclosure
Adobe · Flash Player
Adobe Flash Player fails to properly restrict discovery of memory addresses, allowing attackers to bypass ASLR on Windows and causing an unspecified impact on other platforms. The flaw was exploited in the wild in January 2015, and the affected product is end-of-life, so any remaining deployment is a serious risk.
Description
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is confirmed exploited in the wild and listed in CISA KEV, but the product is end-of-life and the vector requires local user interaction, lowering current practical exposure.
What it is
Adobe Flash Player fails to properly restrict discovery of memory addresses, allowing attackers to bypass ASLR on Windows and causing an unspecified impact on other platforms. The flaw was exploited in the wild in January 2015, and the affected product is end-of-life, so any remaining deployment is a serious risk.
Impact
An attacker gains the ability to defeat ASLR, which removes a key exploit mitigation and makes reliable code-reuse attacks against Flash Player far easier. On non-Windows platforms the impact is unspecified in the record.
Attack surface
The CVSS vector is local with user interaction required (AV:L/UI:R), meaning the victim must open or render attacker-controlled content that triggers Flash Player. No authentication is required (PR:N), and the exact vectors are unknown.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog, and the description states it was exploited in the wild in January 2015; EPSS shows a 30-day probability of 0.15217 (96.6th percentile). No ransomware campaign use is documented.
What to do
- Patch to the fixed Flash Player versions listed in Adobe advisory APSB15-02 (13.0.0.262, 16.0.0.287, 11.2.202.438) or later.
- Since Flash Player is end-of-life, remove or disconnect any system still running it, per CISA required action.
- Block Flash content in browsers and disable the Flash plugin where removal is not immediately possible.
- Restrict user ability to open untrusted documents and web content that could load Flash.
- Apply OS-level exploit mitigations such as EMET or Windows Defender Exploit Guard where legacy Flash must remain.
Detection
- Hunt for Flash Player processes (e.g., FlashPlayerPlugin, npapi-flash) loading from unusual paths or spawned by browsers and office applications.
- Monitor for crashes or memory access anomalies in Flash Player consistent with ASLR probing.
- Review proxy and endpoint logs for known Flash exploit kit landing pages and .swf downloads from untrusted sources.
- Alert on execution of Flash content from email attachments, temp directories, or user-writable paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2015-0310 to the Known Exploited Vulnerabilities catalog on 25 May 2022 as "Adobe Flash Player ASLR Bypass Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 15 June 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-0310 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-0310), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
