CVE-2015-3093: Adobe Flash Player and AIR memory corruption code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 2.0 is 10.0 with network reachability and no authentication, EPSS is near the top percentile, and a public exploit exists, though the product is legacy and CISA KEV does not list it.

What it is

Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler contain a memory corruption flaw (CWE-119) that allows attackers to execute arbitrary code or cause a denial of service. The issue affects Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, before 11.2.202.460 on Linux, and AIR/AIR SDK/AIR SDK & Compiler before 17.0.0.172. It matters because Flash was widely deployed and this class of bug is reliably weaponizable for remote code execution.

Impact

An attacker can execute arbitrary code in the context of the affected process or crash it, leading to full compromise of confidentiality, integrity, and availability. The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C reflects complete impact with no authentication required.

Attack surface

The vector is network-reachable with low complexity and no authentication, consistent with a user visiting a malicious or compromised web page hosting crafted Flash content. User interaction (loading the content in a Flash-enabled browser or AIR application) is implied by the product and vector, though the description does not state the exact trigger.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.47615 (98.79th percentile), indicating high predicted exploitation activity. A public Exploit-DB entry (37846) exists, and the vendor advisory is tagged Patch and Vendor Advisory.

What to do

• Apply the Adobe security update referenced in APSB15-09 to bring Flash Player, AIR, AIR SDK, and AIR SDK & Compiler to the fixed versions.
• Apply the corresponding Linux distribution updates (openSUSE, Red Hat RHSA-2015-1005, Gentoo GLSA 201505-02) where Flash or AIR packages are installed.
• Remove or disable Flash Player and AIR where they are not required; if they must remain, restrict to trusted sites and keep them current.
• Enforce browser settings or extensions that block Flash content by default and require explicit user approval to run.
• Monitor vendor advisories for any later Flash/AIR fixes, since this CVE is one of several memory corruption issues patched in the same cycle.

Detection

• Hunt for Flash Player or AIR processes spawning unexpected child processes (e.g., cmd.exe, powershell.exe, /bin/sh) as a code-execution indicator.
• Monitor for crashes or memory-corruption events in Flash Player/AIR (browser plugin crash reports, Windows Error Reporting, or core dumps) clustered around web browsing.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains serving SWF content, and inspect SWF files for obfuscated ActionScript.
• Check endpoint inventories for Flash Player and AIR versions below the fixed thresholds (13.0.0.289, 17.0.0.188, 11.2.202.460, 17.0.0.172) to identify exposed hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.