CVE-2015-5131: Adobe Flash Player buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 2.0 base score of 10.0 with network reachability and public exploit code, though the product is legacy and no KEV listing or active exploitation is documented.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a buffer overflow (CWE-119) reachable via unspecified vectors. Successful exploitation permits arbitrary code execution in the context of the affected process. The flaw is one of a set of distinct issues fixed in the same Adobe update (CVE-2015-5132 and CVE-2015-5133 are separate).

Impact

An attacker can execute arbitrary code on the victim's system, giving full compromise of confidentiality, integrity and availability as reflected by the CVSS 2.0 score of 10.0.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates network reachability with no authentication and low complexity, consistent with a malicious Flash (SWF) file delivered via a web page or document. User interaction to load the content is implied by the Flash Player context, though the record does not state this explicitly.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.50728, 98.9th percentile) and an Exploit-DB entry (37856) exists, indicating public exploit code is available. No ransomware association is documented.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and to 11.2.202.508 or later on Linux, per Adobe APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply vendor patches for Linux distributions (Red Hat RHSA-2015-1603, openSUSE, Gentoo GLSA 201508-01) where Flash is packaged.
• Where Flash is not required, remove or disable the plugin and block Flash content in browsers.
• Restrict execution of untrusted SWF content and treat Flash as end-of-life software in any remaining deployments.

Detection

• Monitor for Flash Player processes spawning unexpected child processes or making anomalous network connections.
• Hunt for known Exploit-DB 37856 payload patterns and suspicious SWF files delivered from web or email.
• Alert on Flash Player crashes or memory corruption events that may indicate exploitation attempts.
• Audit endpoints for Flash Player versions below the fixed releases listed in APSB15-19.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.