CVE-2015-3105: Adobe Flash Player, AIR and AIR SDK memory corruption code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution with a maximum CVSS v2 score of 10 and very high EPSS, though it is not in KEV and affects legacy, largely retired software.

What it is

Adobe Flash Player, Adobe AIR, AIR SDK and AIR SDK & Compiler contain a memory corruption flaw (CWE-119) reachable through unspecified vectors. Successful exploitation allows arbitrary code execution or a denial of service. The affected product set spans Windows, OS X, Linux and Android, so exposure is broad wherever these runtimes are still installed.

Impact

An attacker can execute arbitrary code in the context of the affected runtime, or crash it to cause a denial of service. Given the runtime's typical privileges, code execution can lead to full compromise of the user's session or host.

Attack surface

The CVSS v2 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction required. The description does not specify the exact vectors, so the precise delivery path (for example, a crafted media file or web content) cannot be confirmed from this record.

Exploitation

CVE-2015-3105 is not listed in CISA KEV and no reference carries an exploit tag, but EPSS is very high at 0.96079 (99.875th percentile), indicating strong predicted exploitation activity. No public exploit or in-the-wild use is confirmed by the supplied data.

What to do

• Upgrade Flash Player to 13.0.0.292 or later, or 18.0.0.160 or later on Windows and OS X, and to 11.2.202.466 or later on Linux.
• Upgrade Adobe AIR to 18.0.0.144 on Windows and 18.0.0.143 on OS X and Android, and AIR SDK / AIR SDK & Compiler to the same fixed versions.
• Apply the vendor advisory APSB15-11 and the referenced distribution errata (Red Hat RHSA-2015-1086, openSUSE, Gentoo GLSA 201506-01).
• Where Flash or AIR is not required, remove or disable it; otherwise restrict untrusted content and keep browser plug-ins current.
• Track end-of-life runtimes and retire them, since these versions are long superseded.

Detection

• Monitor for crashes of Flash Player, AIR or browser plug-in processes, which can indicate memory corruption attempts.
• Hunt for processes loading Flash/AIR content from unusual paths or spawned by browsers, email clients or document readers.
• Review proxy and endpoint logs for delivery of Flash content from untrusted or newly seen domains.
• Verify installed Flash, AIR and AIR SDK versions against the fixed builds and flag any that remain below them.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.