CVE-2015-5127: Adobe Flash Player use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution with complete impact and has public exploit code, though it is not in KEV and the affected product is legacy.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free flaw that lets attackers execute arbitrary code. The issue affects Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, plus AIR and SDK builds before 18.0.0.199. Because Flash content is widely embedded in web pages, this class of bug is a common browser drive-by target.

Impact

An attacker who triggers the flaw can run arbitrary code in the context of the affected process, typically the browser or plugin, giving full control of the user's session. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

The vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity, consistent with a malicious SWF or web page loaded by the victim. The description does not specify the exact trigger, so the precise user interaction required is not stated in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.50 (98.9th percentile) and an Exploit-DB entry (37861) exists, indicating public exploit code is available. No ransomware group is documented as using it.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and 11.2.202.508 or later on Linux, per Adobe APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply the referenced Linux distribution updates (SUSE, Red Hat, Gentoo) where Flash or AIR packages are installed.
• Remove or disable Flash Player where it is no longer required, since the product is end-of-life.
• Restrict browser plugin execution and block untrusted SWF content at the network or endpoint layer.

Detection

• Monitor for Flash Player or browser processes spawning unexpected child processes or writing executables to disk.
• Hunt for crashes in Flash Player or plugin processes that precede suspicious process creation, a common use-after-free indicator.
• Inspect proxy and DNS logs for SWF downloads from untrusted or newly registered domains.
• Check endpoint inventories for Flash Player, AIR or AIR SDK versions below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.