CVE-2015-5540: Adobe Flash Player use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, complete impact, and high EPSS percentile indicate an urgent patching priority despite absence from KEV.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free vulnerability reachable via unspecified vectors. Successful exploitation allows arbitrary code execution in the context of the affected process. The flaw is one of a large batch of similar use-after-free issues fixed in the same Adobe update.

Impact

An attacker can execute arbitrary code on the victim's system, potentially leading to full compromise of the user's session and data. Given the CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C, the impact is complete loss of confidentiality, integrity and availability.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). Exploitation typically requires the victim to load malicious Flash content, implying some form of user interaction such as visiting a crafted web page or opening a malicious document.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.45511 (98.7th percentile), indicating a high likelihood of exploitation activity. A public Exploit-DB entry (37859) exists, and the reference set includes vendor advisories and patch links.

What to do

• Apply the Adobe security update referenced in APSB15-19 to upgrade Flash Player, AIR, AIR SDK and AIR SDK & Compiler to the fixed versions.
• If Flash is not required, disable or uninstall Adobe Flash Player and AIR components from all endpoints.
• Configure browsers to require click-to-play for Flash content and block automatic execution of embedded Flash objects.
• Apply vendor patches from Red Hat, SUSE, Gentoo and HPE for bundled or redistributed Flash/AIR components.
• Restrict network access to untrusted Flash content and monitor for exploitation attempts at the perimeter.

Detection

• Monitor for processes spawning from browser or AIR runtime that exhibit unusual child process creation or memory manipulation.
• Inspect network traffic for Flash content delivery from untrusted sources and correlate with endpoint alerts.
• Review endpoint logs for crashes or anomalous behavior in Flash Player or AIR processes that may indicate use-after-free exploitation.
• Use application allowlisting to prevent execution of unauthorized Flash or AIR binaries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.