CVE-2015-5560: Adobe Flash Player integer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe CVSS 2.0 base score is 10.0 and EPSS is at the 99.2nd percentile, but the record is not in KEV and no exploit reference is tagged, so it is high rather than critical.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain an integer overflow that lets attackers execute arbitrary code. The flaw affects Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, plus the listed AIR builds. Because Flash content is widely embedded, a memory-corruption bug of this class is a serious client-side risk.

Impact

An attacker who triggers the overflow can run arbitrary code in the context of the affected process, giving full control of confidentiality, integrity and availability on the victim host.

Attack surface

The CVSS vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and no user interaction required by the vector itself. The description does not specify the exact delivery vector, so the concrete entry point (for example a crafted SWF) is not stated in the record.

Exploitation

The record is not listed in CISA KEV, but EPSS gives a 30-day probability of 0.65956 (99.2nd percentile), indicating high predicted exploitation activity. No reference is tagged as an exploit, so public exploit code is not confirmed by this data.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and to 11.2.202.508 or later on Linux, per Adobe advisory APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Apply the referenced Red Hat, SUSE and Gentoo errata on Linux hosts that ship Flash.
• If Flash cannot be patched or is no longer needed, disable or remove the plugin and block Flash content in browsers.
• Track the HPE advisories for any bundled or embedded Flash components in those products.

Detection

• Monitor for Flash Player or browser processes spawning unexpected child processes or writing executables, which can indicate successful exploitation.
• Alert on crashes or memory-corruption events in Flash Player and AIR processes, especially following visits to untrusted web content.
• Inventory endpoints and report hosts still running Flash Player below 18.0.0.232 (Windows/OS X) or 11.2.202.508 (Linux) and AIR below 18.0.0.199.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.