CVE-2015-3080: Adobe Flash Player Use-After-Free Allows Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, and complete impact, combined with a very high EPSS percentile and public exploit code, makes this an urgent patching priority.

What it is

Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler contain a use-after-free vulnerability that allows attackers to execute arbitrary code via unspecified vectors. The flaw affects Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, and before 11.2.202.460 on Linux, as well as AIR before 17.0.0.172. Because Flash content is widely embedded in web pages, this is a serious remote code execution issue for unpatched systems.

Impact

An attacker can execute arbitrary code in the context of the affected process, potentially leading to full system compromise. The CVSS 2.0 vector indicates complete confidentiality, integrity, and availability impact.

Attack surface

The vulnerability is reachable over the network (AV:N) with no authentication (Au:N) and low complexity (AC:L), typically by luring a user to view a malicious Flash file or web page. User interaction is implied by the need to load the crafted content, though the record does not explicitly state it.

Exploitation

The record does not list this CVE in CISA KEV, but EPSS is 0.56552 (99th percentile), indicating a high likelihood of exploitation activity. An Exploit-DB entry (37853) is referenced, suggesting public exploit code exists.

What to do

• Apply the vendor patch by upgrading Adobe Flash Player to 13.0.0.289 or later, 17.0.0.188 or later, or 11.2.202.460 or later as applicable, and update Adobe AIR, AIR SDK, and AIR SDK & Compiler to 17.0.0.172 or later.
• If patching is not immediately possible, disable or remove Adobe Flash Player and AIR where they are not required.
• Configure browsers to require click-to-play for Flash content to reduce automatic exploitation.
• Apply the referenced Linux distribution updates (openSUSE, Red Hat, Gentoo) to ensure system packages are patched.

Detection

• Monitor for crashes or abnormal behavior in Flash Player, AIR, or browser processes that could indicate use-after-free exploitation attempts.
• Use endpoint detection to identify suspicious child processes spawned by Flash Player or AIR, such as command shells or scripting engines.
• Review network logs for connections to known malicious domains or exploit kit infrastructure delivering Flash content.
• Check for the presence of Exploit-DB 37853 or similar exploit artifacts in file or memory scans.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.