CVE-2015-3089: Adobe Flash Player, AIR and AIR SDK memory corruption code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 2.0 base score is 10 with network reachability and no authentication, EPSS is near the top percentile, and public exploit code is referenced, though the CVE is not in KEV and the product is legacy.

What it is

Adobe Flash Player, Adobe AIR, AIR SDK and AIR SDK & Compiler contain a memory corruption flaw (CWE-119) that allows attackers to execute arbitrary code or cause a denial of service via unspecified vectors. It affects Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, before 11.2.202.460 on Linux, and AIR/AIR SDK/AIR SDK & Compiler before 17.0.0.172. The record gives no further detail on the exact trigger, so the root cause is only described as memory corruption.

Impact

An attacker can execute arbitrary code in the context of the affected product or crash it, giving full compromise of confidentiality, integrity and availability per the CVSS vector. No privilege escalation beyond the running process is described.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and low complexity, consistent with a malicious SWF or web content loaded by Flash Player or AIR. No user interaction is stated in the record, though typical Flash exploitation requires the victim to load the crafted content.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.47615 (98.79th percentile) and an Exploit-DB entry (37845) is referenced, indicating public exploit code exists. No ransomware group is documented as using it.

What to do

• Upgrade Flash Player to 13.0.0.289 or later, or 17.0.0.188 or later on Windows and OS X, and 11.2.202.460 or later on Linux.
• Upgrade Adobe AIR, AIR SDK and AIR SDK & Compiler to 17.0.0.172 or later.
• Apply the vendor advisory APSB15-09 and the referenced Linux distribution errata (SUSE, Red Hat, Gentoo).
• Remove or disable Flash Player and AIR where they are not required, since the product is end-of-life.
• Restrict execution of untrusted SWF content and block Flash content at the browser or email gateway.

Detection

• Monitor for Flash Player or AIR processes spawning unexpected child processes or making outbound network connections.
• Hunt for crash reports or memory corruption events in Flash Player, AIR, AIR SDK and AIR SDK & Compiler.
• Search endpoint and proxy logs for known Exploit-DB 37845 payload patterns or SWF files matching that exploit.
• Alert on execution of Flash content from untrusted or unusual sources, especially on hosts that still run the affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.