CVE-2015-5134: Adobe Flash Player Use-After-Free Allows Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10.0 with complete impact and network reachability, combined with a high EPSS percentile and public exploit code, makes this a critical risk for any environment still running vulnerable Flash or AIR versions.

What it is

Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler contain a use-after-free vulnerability reachable through unspecified vectors. Successful exploitation allows arbitrary code execution in the context of the affected process. The flaw affects Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, plus AIR and SDK builds before 18.0.0.199.

Impact

An attacker can execute arbitrary code on the victim's system, potentially leading to full compromise of the affected host. Given the CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C, confidentiality, integrity, and availability impacts are all rated complete.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). Exploitation typically requires the victim to load malicious Flash content, implying some form of user interaction such as visiting a crafted web page or opening a malicious document.

Exploitation

The record is not listed in CISA KEV, but EPSS indicates a 30-day exploitation probability of 0.50286 (98.854th percentile), and an Exploit-DB entry (37852) is referenced, suggesting public exploit code exists.

What to do

• Apply the Adobe security update referenced in APSB15-19 to bring Flash Player to 18.0.0.232 (Windows/OS X) or 11.2.202.508 (Linux), and update AIR/AIR SDK to 18.0.0.199 or later.
• Apply vendor patches from Red Hat, openSUSE, Gentoo, and HPE as applicable to affected distributions and products.
• Disable or remove Adobe Flash Player where it is not business-required, and restrict Flash content execution via browser or endpoint policy.
• If Flash cannot be removed, enforce click-to-play and limit Flash execution to trusted sites only.

Detection

• Monitor for processes spawning from browser or Flash plugin contexts, especially unexpected child processes or command shells.
• Inspect network traffic for Flash content (SWF) delivered from untrusted or newly registered domains.
• Review endpoint logs for crashes or memory corruption events in Flash Player, AIR, or related processes.
• Hunt for known Exploit-DB 37852 indicators or related SWF payloads in web proxy and email gateway logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.