CVE-2015-5539: Adobe Flash Player, AIR and AIR SDK use-after-free code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw gives unauthenticated remote code execution with complete impact, public exploit code exists and EPSS is very high, though it is not in KEV and the affected product is now end-of-life.

What it is

CVE-2015-5539 is a use-after-free flaw in Adobe Flash Player, Adobe AIR, and the AIR SDK/SDK & Compiler that allows attackers to execute arbitrary code through unspecified vectors. It is one of a large batch of similar Flash memory-corruption issues fixed in the August 2015 Adobe update, and it matters because Flash was a primary target for drive-by browser exploitation.

Impact

A successful attack lets the attacker run arbitrary code in the context of the affected Flash or AIR process, which on a browsing host can lead to full system compromise. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity, consistent with a malicious SWF or web page loaded in Flash. User interaction, such as visiting a crafted page or opening a malicious file, is not explicitly stated in the record but is typical for this class of Flash bug.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.455 (98.7th percentile) and an Exploit-DB entry (37855) exists, indicating public exploit code is available. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the Adobe security update referenced in APSB15-19 to bring Flash Player, AIR and AIR SDK to the fixed versions (Flash 18.0.0.232 on Windows/OS X, 11.2.202.508 on Linux; AIR and AIR SDK 18.0.0.199).
• Apply the linked Linux distribution updates (Red Hat RHSA-2015-1603, openSUSE, Gentoo GLSA 201508-01) where Flash is packaged by the OS vendor.
• Remove or disable Flash Player and AIR where they are no longer required, since the product is end-of-life and this class of flaw recurs.
• Where Flash must remain, enforce click-to-play and restrict Flash content to trusted sites to reduce exposure to malicious SWF files.
• Update dependent third-party products that bundle Flash, such as the HPE advisories listed in the references.

Detection

• Hunt for Flash Player or AIR processes spawning child processes such as cmd.exe, powershell.exe or /bin/sh, which is abnormal for normal plugin operation.
• Monitor for crashes or memory-corruption events in Flash Player/AIR (for example Windows Error Reporting or browser plugin crash telemetry) that cluster around browsing activity.
• Review proxy and DNS logs for requests to known exploit-kit or malicious SWF hosting patterns, and inspect SWF files delivered to endpoints.
• Check endpoint inventories for Flash Player and AIR versions below the fixed builds listed in APSB15-19.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.