ZeroDay Findings
Sign inSign up

Findings

CVE-2015-5122

Adobe Flash Player Use-After-Free Vulnerability

Published Jul 14, 2015 · updated Jun 16, 2026 · adobe flash player

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 14, 2015 · Catalog

    Detected

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti

  2. Apr 13, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. May 4, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date May 4, 2022

Affected

  • cpe adobe/flash playerversion unspecified
  • cpe adobe/flash player desktop runtimeversion unspecified
  • cpe opensuse/evergreen11.4
  • cpe redhat/enterprise linux desktop5.0
  • vendor Adobe Flash Playerversion unspecified

Sources

  • CISA KEVCVE-2015-5122

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

    cisa.gov
  • CVE.orgCVE-2015-5122

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-5122

    30-day exploitation probability 93.9%

    first.org
  • Exploit Database37599

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/browser/adobe_flash_opaque_background_uaf

    Public module reference (great). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2015-5122

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Li

    nvd.nist.gov

References

CVE-2015-5122 · ZeroDay Findings