CVE-2015-3087: Adobe Flash Player Integer Overflow Allows Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication and complete impact, plus very high EPSS and public exploit code, make this a top remediation priority.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain an integer overflow (CWE-189) that allows attackers to execute arbitrary code via unspecified vectors. The flaw affects Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, and before 11.2.202.460 on Linux, plus AIR and SDK builds before 17.0.0.172. It matters because Flash was widely deployed and this is a network-reachable, unauthenticated code execution issue.

Impact

An attacker can execute arbitrary code in the context of the affected process, giving full control of confidentiality, integrity and availability on the target host. No privileges are required beyond reaching the victim.

Attack surface

Reached over the network (AV:N) with low complexity and no authentication (AC:L/Au:N), typically by delivering a crafted SWF or Flash content to a user. The record does not specify whether user interaction is required, but the vector indicates no authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.74294, 99.465th percentile) and an Exploit-DB entry (37843) exists, indicating public exploit code is available.

What to do

• Apply the Adobe security update (APSB15-09) to Flash Player, AIR, AIR SDK and AIR SDK & Compiler at the fixed versions listed.
• If Flash cannot be patched, disable or remove Flash Player and block Flash content in browsers.
• Apply vendor errata from Red Hat, SUSE/openSUSE and Gentoo for packaged Flash builds.
• Restrict or block untrusted SWF content at the network and email gateway.
• Retire Flash-dependent applications where feasible, as the platform is end-of-life.

Detection

• Monitor for Flash Player processes spawning unexpected child processes or making anomalous network connections.
• Hunt for known Exploit-DB 37843 payload patterns or SWF files matching public exploit indicators.
• Alert on Flash Player crashes or memory corruption events on endpoints.
• Track Flash Player version inventory to find hosts below the fixed versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.