CVE-2015-5556: Adobe Flash Player, AIR use-after-free allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityMaximum CVSS v2 impact and a very high EPSS percentile make this a serious code-execution flaw, though it is an old, patched issue and not in KEV.

What it is

Adobe Flash Player, Adobe AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free vulnerability reachable through unspecified vectors. Successful exploitation lets an attacker run arbitrary code in the context of the affected runtime, which is why the record carries a maximum CVSS v2 score of 10.0. The flaw is one of a large batch of similar use-after-free issues fixed in the same Adobe update.

Impact

An attacker gains arbitrary code execution under the privileges of the process running Flash Player or AIR, typically the logged-in user. That can lead to full compromise of the host, data theft or further lateral movement.

Attack surface

The CVSS v2 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and low complexity, consistent with a victim loading attacker-controlled Flash content in a browser or AIR application. User interaction (opening the malicious content) is implied by the delivery model but is not stated in the record.

Exploitation

The record is not listed in CISA KEV and no reference is tagged as an exploit, so public exploit availability is not confirmed here. EPSS is high at roughly 0.448 probability (98.7th percentile), indicating elevated predicted exploitation activity.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and to 11.2.202.508 or later on Linux, per Adobe advisory APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply the referenced Linux distribution updates (Red Hat RHSA-2015-1603, openSUSE, Gentoo GLSA 201508-01) where Flash is packaged by the OS vendor.
• Where Flash is not required, remove or disable the plugin and block Flash content to eliminate the attack surface.
• Treat Flash content from untrusted sources as hostile and restrict browser plugin execution via policy.

Detection

• Hunt for Flash Player or AIR processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh, which is atypical for normal plugin behavior.
• Monitor for crashes or abnormal termination of Flash Player/AIR followed by suspicious process creation, a common pattern for use-after-free exploitation.
• Alert on Flash content loaded from unusual or newly registered domains and on outbound connections from browser or AIR processes to untrusted hosts.
• Inventory endpoints still running Flash Player or AIR versions below the fixed builds listed in APSB15-19.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.