CVE-2015-5551: Adobe Flash Player use-after-free allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe vulnerability allows unauthenticated remote code execution with full impact and has a high EPSS score, but it is not listed in CISA KEV and affects legacy software that may be less prevalent today.

What it is

Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler contain a use-after-free vulnerability that allows attackers to execute arbitrary code. The flaw is triggered via unspecified vectors and affects Flash Player before 18.0.0.232 on Windows/OS X and before 11.2.202.508 on Linux, plus AIR before 18.0.0.199. It matters because Flash was widely deployed and this class of bug gives full code execution in the context of the affected process.

Impact

An attacker can execute arbitrary code on the victim's system, potentially leading to complete compromise of confidentiality, integrity, and availability. The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates unauthenticated remote code execution with full impact.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L). Exploitation likely requires the victim to load malicious Flash content, such as a crafted SWF file in a browser or application, which implies some form of user interaction to visit a page or open a file.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (30-day probability 0.44792, 98.7th percentile). No public exploit references are tagged in the provided data, so active exploitation is not confirmed by the record.

What to do

• Apply the Adobe security update referenced in APSB15-19 to upgrade Flash Player, AIR, AIR SDK, and AIR SDK & Compiler to the fixed versions.
• If Flash cannot be patched immediately, disable or remove Adobe Flash Player and AIR where business use does not require them.
• Configure browsers to require click-to-play for Flash content and restrict untrusted SWF execution.
• Apply vendor patches from Red Hat, SUSE, Gentoo, and HPE for bundled or dependent Flash components.
• Monitor for and block known malicious SWF files and Flash exploit delivery vectors at the network and endpoint level.

Detection

• Hunt for processes loading Flash Player or AIR modules and spawning unexpected child processes, which may indicate successful exploitation.
• Monitor for crashes or memory corruption events in Flash Player (e.g., Windows Error Reporting or core dumps) that could correspond to use-after-free attempts.
• Inspect network and proxy logs for SWF file downloads from untrusted or newly registered domains.
• Review endpoint telemetry for suspicious behavior originating from browser or AIR processes, such as writing executables or making unusual outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.