CVE-2015-5561: Adobe Flash Player use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a 10.0 CVSS 2.0 score and very high EPSS, though the product is legacy and no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free vulnerability that lets attackers execute arbitrary code. The flaw is one of a large batch of similar memory-corruption issues fixed in the same Adobe update, and it affects Windows, OS X and Linux builds. Because Flash content is widely embedded and the flaw is remotely reachable, it matters for any environment still running unpatched Flash or AIR.

Impact

An attacker can execute arbitrary code in the context of the affected process, which for a browser plugin typically means the user's session and potentially full host compromise. The CVSS 2.0 vector rates complete confidentiality, integrity and availability impact.

Attack surface

The vector is AV:N/AC:L/Au:N, so it is network reachable with no authentication required. The description does not specify the exact delivery path, but Flash flaws of this class are normally reached by a victim loading crafted content, so some form of user interaction (opening a page or file) is likely.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is 0.44792 (98.7th percentile), indicating a high modeled probability of exploitation activity. No public exploit details are given in the record.

What to do

• Patch Flash Player to 18.0.0.232 or later on Windows and OS X, and 11.2.202.508 or later on Linux, per Adobe APSB15-19.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• If Flash cannot be patched or removed, disable the plugin in browsers and block Flash content by default.
• Prioritize removal of Flash and AIR from endpoints, since the product line is end-of-life and no longer receives security fixes.
• Apply the referenced Red Hat, openSUSE and Gentoo advisories on Linux hosts to keep distribution packages current.

Detection

• Hunt for Flash Player or AIR versions below the fixed builds on endpoints and inventory any remaining installations.
• Monitor for browser or plugin process crashes followed by unexpected child process creation, a common pattern for use-after-free exploitation.
• Alert on Flash content (.swf) downloads or executions from untrusted or unusual sources.
• Review proxy and endpoint logs for known Flash exploit kit landing pages and payload delivery.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.