CVE-2015-3113: Adobe Flash Player heap buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, confirmed in-the-wild exploitation, and CISA KEV listing with an extremely high EPSS score make this a top-priority vulnerability for any system still running Flash.

What it is

Adobe Flash Player contains a heap-based buffer overflow (CWE-122/CWE-787) reachable through unspecified vectors. It affects Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X, and before 11.2.202.468 on Linux. The flaw was exploited in the wild in June 2015, making it a serious remote code execution risk for unpatched systems.

Impact

A remote attacker can execute arbitrary code in the context of the Flash Player process, potentially leading to full system compromise. No privilege escalation or user credentials are required beyond the victim loading the malicious content.

Attack surface

Reached over the network via unspecified vectors, likely malicious SWF content or a crafted web page, with no authentication required. The CVSS vector indicates no user interaction (UI:N), though in practice Flash content typically loads when a user visits a page or opens a document.

Exploitation

Adobe confirmed exploitation in the wild in June 2015, and the CVE is listed in CISA KEV with a 2022 remediation due date. EPSS probability is 0.9994 (99.97th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Adobe fix: upgrade Flash Player to 13.0.0.296 or later, 18.0.0.194 or later for 14.x-18.x, or 11.2.202.468 or later on Linux.
• Since Flash Player is end-of-life, remove or disable it entirely; CISA's required action is to disconnect the impacted product if still in use.
• Apply vendor updates for bundled or redistributed Flash in SUSE, openSUSE, Red Hat, and HP products listed in the references.
• Block or restrict execution of Flash content and untrusted SWF files at the browser and endpoint level.
• If Flash cannot be removed, isolate affected systems and restrict outbound browsing to reduce exposure.

Detection

• Monitor for Flash Player process crashes or abnormal memory behavior that could indicate heap overflow exploitation attempts.
• Hunt for known exploit artifacts and suspicious SWF files delivered via email, web downloads, or drive-by pages.
• Review endpoint and proxy logs for connections to known malicious or exploit-hosting domains tied to Flash campaigns from mid-2015 onward.
• Check installed Flash Player versions across endpoints and flag any below the fixed versions listed above.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.