CVE-2015-5119: Adobe Flash Player ActionScript 3 ByteArray use-after-free

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, confirmed in-the-wild exploitation, CISA KEV listing and near-maximum EPSS make this a top-priority vulnerability for any system still running Flash Player.

What it is

A use-after-free flaw exists in the ByteArray class of the ActionScript 3 implementation in Adobe Flash Player. Crafted Flash content that overrides a valueOf function can corrupt memory, allowing remote code execution or a denial of service. The affected product is end-of-life, so any remaining deployment carries full risk.

Impact

An attacker can execute arbitrary code in the context of the Flash Player process or crash it, giving code execution on the victim host. Successful exploitation can lead to full compromise of the user's system.

Attack surface

Reached remotely over the network by delivering crafted Flash content to a browser or application hosting Flash Player; no authentication or user privileges are required, though the victim must load the malicious content. The CVSS vector shows network access, low complexity, no privileges and no user interaction.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-03, and the description states it was exploited in the wild in July 2015. EPSS is 0.99344 (99.9th percentile), and references include an exploit module and a public exploit write-up.

What to do

• Patch or remove Flash Player immediately; Adobe Flash Player is end-of-life and CISA's required action is to disconnect the product if still in use.
• If Flash cannot be removed, disable or block Flash content in browsers and applications via enterprise policy.
• Apply vendor updates for any bundled Flash components on Red Hat, openSUSE and SUSE Linux distributions.
• Restrict network access to untrusted Flash content and block known malicious domains and exploit delivery paths.
• Retire or isolate systems that still depend on Flash Player.

Detection

• Monitor for Flash Player process crashes and memory corruption events, especially from browser plugins.
• Hunt for known exploit artifacts and payloads associated with the ByteArray valueOf use-after-free, including the public exploit module.
• Review proxy and network logs for delivery of crafted SWF content or known exploit hosts.
• Check endpoint telemetry for suspicious child processes spawned by browsers or Flash Player.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.