← Vulnerability feed

Vulnerability record · CVE-2015-5123 · published 14 July 2015

CVE-2015-5123: Adobe Flash Player ActionScript 3 BitmapData use-after-free

Redhat · Enterprise Linux Desktop

Adobe Flash Player contains a use-after-free in the ActionScript 3 BitmapData class, triggered by crafted Flash content that overrides a valueOf function. It affects Flash Player 13.x through 18.x on Windows, OS X, and Linux, and was exploited in the wild in July 2015. The flaw allows remote code execution or memory-corruption denial of service.

9.8 CVSS 3.1 Critical CISA KEV since 13 Apr 2022 EPSS 19% · top 2.8% CWE-416 · Use after free
9.8CVSS 3.1 base score, v2 10.0
19%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
9Affected product versions listed by NVD
30References
17 Jun 2026Last modified by NVD

Description

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, and confirmed in-the-wild exploitation make this a critical, actively exploited remote code execution flaw.

What it is

Adobe Flash Player contains a use-after-free in the ActionScript 3 BitmapData class, triggered by crafted Flash content that overrides a valueOf function. It affects Flash Player 13.x through 18.x on Windows, OS X, and Linux, and was exploited in the wild in July 2015. The flaw allows remote code execution or memory-corruption denial of service.

Impact

An attacker can execute arbitrary code in the context of the Flash Player process, or crash it to cause a denial of service. Successful exploitation gives code execution on the victim host without privileges.

Attack surface

Reached remotely over the network by delivering crafted Flash content to a browser or player; the CVSS vector shows no privileges and no user interaction required, though in practice a victim must load the malicious content. No authentication is needed.

Exploitation

Adobe Flash Player is listed in CISA KEV (added 2022-04-13), and the description states it was exploited in the wild in July 2015. EPSS 30-day probability is 0.18493 (97th percentile), indicating high predicted exploitation activity.

What to do

  • Apply the Adobe Flash Player update referenced in APSB15-18 (or later) on any remaining installations.
  • Because Flash Player is end-of-life, disconnect or remove it from systems per the CISA KEV required action.
  • Disable or block Flash content in browsers and email clients via policy.
  • Remove or restrict the Flash Player browser plug-in and desktop runtime on Windows, OS X, and Linux hosts.
  • Track vendor errata (Red Hat RHSA-2015-1235, openSUSE, SUSE, Gentoo GLSA 201508-01) to confirm patched or removed packages.

Detection

  • Hunt for Flash Player processes loading untrusted SWF content, especially from email or web downloads.
  • Monitor for crashes in Flash Player (memory corruption) that precede exploitation attempts.
  • Search endpoint logs for Flash Player versions in the affected ranges (13.x-18.x) still installed.
  • Review proxy and browser logs for SWF retrieval from suspicious or newly registered domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2015-5123 to the Known Exploited Vulnerabilities catalog on 13 April 2022 as "Adobe Flash Player Use-After-Free Vulnerability". Required action: The impacted product is end-of-life and should be disconnected if still in use. Federal deadline 4 May 2022.

Affected products

9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerg Broken LinkThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html Mailing ListThird Party Advisory
http://marc.info/?l=bugtraq&m=144050155601375&w=2 Mailing ListThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1235.html Third Party Advisory
http://www.kb.cert.org/vuls/id/918568 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/75710 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1032890 Broken LinkThird Party AdvisoryVDB Entry
http://www.us-cert.gov/ncas/alerts/TA15-195A Third Party AdvisoryUS Government Resource
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 Broken LinkThird Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html Broken LinkVendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html Broken LinkVendor Advisory
https://security.gentoo.org/glsa/201508-01 Third Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerg Broken LinkThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html Mailing ListThird Party Advisory
http://marc.info/?l=bugtraq&m=144050155601375&w=2 Mailing ListThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1235.html Third Party Advisory
http://www.kb.cert.org/vuls/id/918568 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/75710 Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1032890 Broken LinkThird Party AdvisoryVDB Entry
http://www.us-cert.gov/ncas/alerts/TA15-195A Third Party AdvisoryUS Government Resource
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 Broken LinkThird Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html Broken LinkVendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html Broken LinkVendor Advisory
https://security.gentoo.org/glsa/201508-01 Third Party Advisory
https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5123 US Government Resource

Track CVE-2015-5123 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-5544OpenSLP heap out-of-bounds write in VMware ESXi and Horizon DaaSOpenSLP as shipped in VMware ESXi and Horizon DaaS contains a heap overwrite (out-of-bounds write) flaw. VMware rates it Critical with a maximum CVSS…KEVEPSS 97%analysed9.8CVE-2019-11043PHP-FPM buffer overflow enables remote code executionPHP-FPM in certain configurations writes past allocated buffers into FCGI protocol data space, an out-of-bounds write (CWE-787, CWE-120). It affects …KEVEPSS 100%analysed9.8CVE-2016-4171Adobe Flash Player unspecified remote code execution flawCVE-2016-4171 is an unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier that allows remote attackers to execute arbitrary code thr…KEVEPSS 20%analysed9.8CVE-2016-4117Adobe Flash Player unspecified vectors allow arbitrary code executionAdobe Flash Player 21.0.0.226 and earlier contains a critical flaw that lets remote attackers execute arbitrary code through unspecified vectors. Ado…KEVEPSS 94%analysed9.8CVE-2016-3427Oracle Java SE JMX Improper Access Control VulnerabilityCVE-2016-3427 is an unspecified vulnerability in Oracle Java SE 6u113, 7u99, 8u77, Java SE Embedded 8u77, and JRockit R28.3.9, reached through vector…KEVEPSS 92%analysed9.8CVE-2016-1019Adobe Flash Player memory corruption allows code executionAdobe Flash Player 21.0.0.197 and earlier contains an unspecified memory corruption flaw that can crash the application or allow arbitrary code execu…KEVEPSS 22%analysed9.8CVE-2015-2590Oracle Java SE Libraries flaw allows remote code executionCVE-2015-2590 is an unspecified vulnerability in the Libraries component of Oracle Java SE 6u95, 7u80, 8u45 and Java SE Embedded 7u75, 8u33. The reco…KEVEPSS 25%analysed9.8CVE-2015-5122Adobe Flash Player ActionScript 3 Use-After-Free in DisplayObjectA use-after-free flaw in the DisplayObject class of Adobe Flash Player's ActionScript 3 implementation is triggered by crafted Flash content that mis…KEVEPSS 94%analysed

Source: NIST National Vulnerability Database (record CVE-2015-5123), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.