CVE-2015-5557: Adobe Flash Player use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw gives unauthenticated remote code execution with a CVSS 2.0 score of 10.0 and a very high EPSS percentile, though it is not in KEV and the affected product is legacy.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free flaw that lets attackers execute arbitrary code. The affected versions are Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, and AIR/AIR SDK/AIR SDK & Compiler before 18.0.0.199. The record does not describe the specific vectors, so the exact trigger is unknown.

Impact

An attacker can execute arbitrary code in the context of the affected runtime, which on a desktop typically means full compromise of the user's session. CVSS 2.0 scores it 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), reflecting complete confidentiality, integrity and availability loss.

Attack surface

The CVSS vector is network-reachable with no authentication and low complexity, consistent with a malicious SWF or web page loaded by the victim. User interaction is not stated in the record but is implied by the browser or runtime delivery model; the description gives no further detail on the entry point.

Exploitation

Not listed in CISA KEV, but EPSS is 0.44792 (98.7th percentile), indicating a high modeled likelihood of exploitation. No reference is tagged as exploit code, so public exploit availability is not confirmed by this record.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and 11.2.202.508 or later on Linux, per Adobe APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply the referenced Red Hat, SUSE, Gentoo and HPE advisories for bundled or redistributed Flash components.
• If Flash cannot be patched or removed, disable the plugin in browsers and block SWF content at the perimeter.
• Retire Flash Player where business use no longer requires it, since the product is end-of-life.

Detection

• Monitor for Flash Player or AIR processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh.
• Alert on crashes or memory-corruption events in Flash Player or AIR modules that precede suspicious process activity.
• Hunt for SWF files delivered from unusual referrers, newly registered domains or email attachments.
• Inventory endpoints and servers still running Flash Player or AIR below the fixed versions listed in APSB15-19.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.