CVE-2015-5550: Adobe Flash Player, AIR and AIR SDK use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw gives unauthenticated remote code execution with complete impact and a high EPSS score, but it is a decade-old issue with a vendor patch available and no KEV listing.

What it is

CVE-2015-5550 is a use-after-free flaw in Adobe Flash Player, Adobe AIR, AIR SDK and AIR SDK & Compiler that lets attackers execute arbitrary code through unspecified vectors. It is one of a large batch of similar Flash memory-corruption bugs fixed in the August 2015 update, and it matters because Flash was widely deployed and such flaws were routinely weaponised for drive-by compromise.

Impact

An attacker who triggers the flaw can run arbitrary code in the context of the affected process, typically leading to full compromise of the user's system. The CVSS v2 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

The CVSS vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity, consistent with a victim loading malicious Flash content in a browser or AIR application. No user interaction value is given in the record, but delivery of the malicious content would normally require the user to open or view it.

Exploitation

The record is not listed in CISA KEV and no reference carries an exploit tag, so there is no confirmed in-the-wild exploitation evidence here. EPSS is high at roughly 0.448 (98.7th percentile), indicating a strong statistical likelihood of exploitation activity.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and 11.2.202.508 or later on Linux, per Adobe advisory APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply the referenced Linux distribution updates (Red Hat RHSA-2015-1603, openSUSE, Gentoo GLSA 201508-01) where Flash is packaged by the OS vendor.
• Remove or disable Flash Player and AIR where they are no longer required, since the platform is end-of-life.
• Restrict or block untrusted Flash content at the browser and network perimeter.

Detection

• Hunt for Flash Player or AIR processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh.
• Monitor for Flash content downloads from unusual or newly registered domains and for exploit-kit style redirect chains.
• Check endpoint inventories for Flash Player and AIR versions below the fixed builds listed above.
• Review crash reports and memory-corruption telemetry from Flash processes for signs of exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.