CVE-2015-5563: Adobe Flash Player, AIR and AIR SDK use-after-free code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution with a maximum CVSS v2 score and a high EPSS percentile, though it is not in KEV and the affected product is end-of-life.

What it is

Adobe Flash Player, Adobe AIR and the AIR SDK contain a use-after-free vulnerability that lets attackers execute arbitrary code. The flaw is one of a large batch of similar use-after-free issues fixed in the same Adobe update, and it affects Windows, OS X and Linux builds. Because Flash content is widely embedded and the flaw is remotely reachable without authentication, it matters for any environment still running unpatched Flash or AIR.

Impact

An attacker can execute arbitrary code in the context of the affected process, which for a browser plugin typically means the user's session. Full compromise of confidentiality, integrity and availability is possible per the CVSS vector.

Attack surface

The CVSS vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and low complexity. The description does not specify the exact vectors, but Flash Player flaws of this class are normally triggered by viewing crafted SWF content, so user interaction such as opening a page or file is likely required.

Exploitation

CISA KEV does not list this CVE, but EPSS gives a 30-day probability of about 0.458 (98.7th percentile), indicating high predicted exploitation activity. Reference tags only mark the Adobe advisory as Patch and Vendor Advisory; no public exploit or in-the-wild tag is present in the record.

What to do

• Update Flash Player to 18.0.0.232 or later on Windows and OS X, and 11.2.202.508 or later on Linux.
• Update Adobe AIR, AIR SDK and AIR SDK & Compiler to 18.0.0.199 or later.
• Remove or disable Flash Player and AIR where they are no longer required, since the product line is end-of-life.
• Apply the linked vendor and distribution advisories (Adobe APSB15-19, Red Hat RHSA-2015-1603, openSUSE, Gentoo GLSA) to cover bundled deployments.
• Restrict or block untrusted SWF content at the browser and email gateway as a compensating control.

Detection

• Monitor for Flash Player or AIR processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh.
• Hunt for crashes or abnormal terminations of Flash Player, browser plugin containers and AIR runtime processes.
• Review proxy and web logs for SWF downloads from untrusted or newly seen hosts.
• Check endpoint inventories for Flash Player and AIR versions below the fixed releases listed in the Adobe advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.