CVE-2015-5132: Adobe Flash Player Buffer Overflow Allows Arbitrary Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with complete impact, public exploit code, and very high EPSS, though the product is legacy and no KEV listing is present.

What it is

Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler contain a buffer overflow (CWE-119) that allows attackers to execute arbitrary code via unspecified vectors. The flaw affects Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, and AIR/AIR SDK/AIR SDK & Compiler before 18.0.0.199. It matters because Flash was widely deployed and this is a remotely reachable, unauthenticated code execution issue.

Impact

An attacker can execute arbitrary code in the context of the affected process, potentially leading to full system compromise. Given the CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C, confidentiality, integrity, and availability impacts are all complete.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). Exploitation likely requires a user to load malicious Flash content, but the record does not specify the exact vectors or whether user interaction is mandatory.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.50728, 98.867th percentile) and an Exploit-DB entry (37857) exists, indicating public exploit code is available.

What to do

• Patch immediately: upgrade Flash Player to 18.0.0.232 or later on Windows/OS X, 11.2.202.508 or later on Linux, and AIR/AIR SDK/AIR SDK & Compiler to 18.0.0.199 or later.
• If patching is not possible, disable or remove Adobe Flash Player and AIR where they are not required.
• Restrict or block Flash content in browsers and email clients, and enforce click-to-play for any remaining Flash usage.
• Apply vendor advisories from Adobe, Red Hat, openSUSE, Gentoo, and HPE for affected distributions and bundled products.

Detection

• Monitor for Flash Player or AIR processes spawning unexpected child processes or making anomalous network connections.
• Hunt for known Exploit-DB 37857 exploit artifacts and related Flash exploit patterns in endpoint and network telemetry.
• Track Flash Player and AIR version inventory to identify unpatched hosts below the fixed versions.
• Review proxy and IDS logs for delivery of malicious SWF content to endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.