60
CVE-2015-5119
KEVmassUse-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray)
CISA: Adobe Flash Player Use-After-Free Vulnerability
CVSS
—
EPSS
99%p100
Published
—
KEV added
AI analysis
CVE-2015-5119 is a use-after-free memory-corruption vulnerability (CWE-119) in the ActionScript 3 ByteArray class of Adobe Flash Player. It is triggered when Flash processes crafted ActionScript/SWF content — typically a malicious .swf loaded from a web page, advertisement, email attachment, or document — causing Flash to access already-freed memory in an attacker-controllable way. A successful attack gives the adversary remote code execution in the context of the user running Flash. Anyone with Adobe Flash Player installed was exposed; at disclosure Flash was on the vast majority of internet-connected desktops, and today risk is concentrated in legacy browsers, office/document tooling, industrial or enterprise applications, and other systems where Flash was never removed. Exploitation status: this flaw has long-standing in-the-wild use (related headlines tie the leaked Hacking Team Flash exploit to APT campaigns against Japanese, East Asian, and US Government targets and to top 2016 exploit kits), it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03; ransomware use unknown), and EPSS assigns a 99.3% probability of exploitation within 30 days.
What to do: Because Flash Player is end-of-life, CISA's required action is to disconnect it rather than patch: audit browsers, document/office tooling, and legacy or industrial applications for Flash dependencies and fully uninstall or disable Flash and any embedded SWF players. If a system must keep Flash temporarily, verify it runs a patched build from 2015 or later (Adobe's July 2015 emergency update, APSB15-16, addressed this flaw) and block untrusted SWF content via browser settings, email gateway, and web filtering. Prioritize cleanup on internet-facing endpoints and users who browse the web or open untrusted email attachments, the typical delivery route for this exploit.
Affected
| Adobe Flash Player | — |
Estimated exposure
mass≈ millions of legacy desktop installations — At the time of the 2015 disclosure Flash Player was installed on roughly 95% of internet-connected PCs (hundreds of millions of seats), and although Flash reached end-of-life in 2020 and most users removed it, unremediated legacy installs…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
CISA Known Exploited Vulnerability
- Affected
- Adobe Flash Player
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- Due date
- Ransomware use
- Unknown
- Vendors
- Adobe
- Products
- Flash Player
- Weakness
- CWE-119
In the news19 stories
60
60
60
60
60
BlackOasis APT leverages new Flash zero
60
60
BlackOasis APT and new targeted attacks leveraging zero
60
60
60
60
60
47
47
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
36
35
35
35