CVE-2015-5122: Adobe Flash Player ActionScript 3 Use-After-Free in DisplayObject

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, confirmed in-the-wild exploitation, CISA KEV listing, and very high EPSS score make this an urgent risk despite the product being end-of-life.

What it is

A use-after-free flaw in the DisplayObject class of Adobe Flash Player's ActionScript 3 implementation is triggered by crafted Flash content that mishandles the opaqueBackground property. Successful exploitation allows arbitrary code execution or memory corruption leading to denial of service. The vulnerability was exploited in the wild in July 2015 and affects Flash Player across Windows, OS X, and Linux, including Chrome installations.

Impact

An attacker can execute arbitrary code in the context of the affected Flash Player process or crash it, giving full control of the victim's system or causing a denial of service.

Attack surface

The flaw is reached remotely over the network by delivering malicious Flash content to a vulnerable Flash Player instance; no authentication is required, and the CVSS vector indicates no user interaction is needed, though in practice a user typically must load the crafted content.

Exploitation

Exploitation is confirmed in the wild and the CVE is listed in CISA KEV with a required action to disconnect end-of-life product; EPSS probability is 0.93688 (99.8th percentile), and public exploit references exist.

What to do

• Patch or remove Adobe Flash Player immediately; the product is end-of-life and CISA requires disconnecting it if still in use.
• Disable or uninstall Flash Player browser plugins across all endpoints and block Flash content at the network perimeter.
• Apply vendor updates for affected Linux distributions (Red Hat, openSUSE, SUSE) that bundle Flash Player.
• Enforce browser policies that prevent automatic execution of Flash content and restrict untrusted web content.
• Monitor for and isolate any systems that cannot remove Flash, treating them as high-risk.

Detection

• Hunt for processes loading Flash Player binaries (e.g., NPSWF32.dll, libflashplayer.so) on endpoints that should not have Flash installed.
• Monitor network traffic for known Flash exploit delivery patterns and domains associated with CVE-2015-5122.
• Review endpoint logs for crashes or abnormal memory behavior in Flash Player processes.
• Search for public exploit artifacts (e.g., from Exploit-DB 37599 or Packet Storm) in file or web proxy logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.