Vulnerability record · CVE-2015-0311 · published 23 January 2015
CVE-2015-0311: Adobe Flash Player unspecified flaw allows remote code execution
Adobe · Flash Player
CVE-2015-0311 is an unspecified vulnerability in Adobe Flash Player affecting versions through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux. It allows remote attackers to execute arbitrary code via unknown vectors and was exploited in the wild in January 2015. The lack of technical detail makes root-cause analysis difficult, but the impact and active exploitation make it a serious concern for any system still running Flash.
Description
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, active in-the-wild exploitation, CISA KEV listing, and very high EPSS score make this an urgent risk for any system still running Flash Player.
What it is
CVE-2015-0311 is an unspecified vulnerability in Adobe Flash Player affecting versions through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux. It allows remote attackers to execute arbitrary code via unknown vectors and was exploited in the wild in January 2015. The lack of technical detail makes root-cause analysis difficult, but the impact and active exploitation make it a serious concern for any system still running Flash.
Impact
A remote attacker can execute arbitrary code in the context of the affected Flash Player process, potentially leading to full system compromise. Given the CVSS 3.1 score of 9.8 (C:H/I:H/A:H), confidentiality, integrity, and availability are all fully impacted.
Attack surface
The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with no authentication and no user interaction required, though the description does not specify the exact delivery vector. In practice, Flash content is typically delivered via web pages or embedded objects, but the record does not confirm the precise mechanism.
Exploitation
CVE-2015-0311 is listed in CISA KEV (added 2022-04-13) and the description states it was exploited in the wild in January 2015. EPSS probability is 0.8582 (99.7th percentile), indicating a very high likelihood of exploitation activity.
What to do
- Apply the Adobe security update referenced in APSB15-03 or later Flash Player versions; if patching is not possible, remove or disable Flash Player.
- Because Flash Player is end-of-life, disconnect affected systems from the network or isolate them per CISA KEV guidance.
- Block Flash content execution in browsers and email clients via enterprise policy or browser configuration.
- Inventory all systems for Flash Player installations, including Windows, macOS, and Linux hosts, and prioritize removal.
- Monitor vendor advisories from Adobe, Microsoft, SUSE, and Gentoo for any remaining platform-specific guidance.
Detection
- Hunt for Flash Player processes (e.g., FlashPlayerPlugin, flashplayer) spawning unexpected child processes or making outbound network connections.
- Review proxy and DNS logs for known Flash exploit kit delivery patterns and suspicious .swf file downloads.
- Search endpoint telemetry for memory corruption indicators or anomalous behavior in browsers loading Flash content.
- Correlate CISA KEV and EPSS data with asset inventory to identify unpatched or end-of-life Flash installations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2015-0311 to the Known Exploited Vulnerabilities catalog on 13 April 2022 as "Adobe Flash Player Remote Code Execution Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 4 May 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-0311 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-0311), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
