CVE-2015-5574: Adobe Flash Player use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution with complete impact and has public exploit code, but it is a decade-old issue with patches available and no KEV listing.

What it is

Adobe Flash Player, AIR, AIR SDK and AIR SDK & Compiler contain a use-after-free flaw that lets attackers execute arbitrary code via unspecified vectors. It affects Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X, and before 11.2.202.521 on Linux, plus AIR before 19.0.0.190. The record does not describe the specific memory object or trigger, so the exact mechanism is unknown.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the affected player, which typically means full compromise of the user's system. The CVSS 2.0 vector rates complete confidentiality, integrity and availability impact.

Attack surface

The vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and no user interaction required by the scoring, though Flash content is normally delivered through a browser or document. No further detail on the delivery path is given in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS gives a 30-day probability of 0.455 (98.7th percentile), and an Exploit-DB entry (39652) is referenced, indicating public exploit code exists.

What to do

• Update Flash Player to 18.0.0.241 or later on Windows and OS X, 19.0.0.185 or later for 19.x, and 11.2.202.521 or later on Linux, and update AIR/AIR SDK to 19.0.0.190 or later.
• Apply the vendor advisory APSB15-23 and any distribution errata (Red Hat RHSA-2015-1814, openSUSE, Gentoo GLSA 201509-07) for managed Linux hosts.
• Remove or disable Flash Player where it is not required, and restrict browser plugins to trusted sites.
• If Flash cannot be removed, isolate browsing in a hardened or disposable environment and block untrusted Flash content.
• Track HPE advisories for bundled Flash components in affected products.

Detection

• Monitor for Flash Player processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh.
• Hunt for crashes or abnormal termination of Flash Player and browser plugin processes that may indicate use-after-free attempts.
• Review proxy and IDS logs for Flash (.swf) content served from untrusted or newly registered domains.
• Check endpoint inventories for Flash Player, AIR and AIR SDK versions below the fixed builds listed in APSB15-23.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.