Vulnerability · CVE-2015-5122

Adobe Flash Player Use-After-Free Vulnerability

Published Jul 5, 2015 · catalog updated Jun 16, 2026 · Adobe Flash Player

Patch now

CVE-2015-5122 is in the CISA known-exploited catalog, due May 4, 2022. Confirm Adobe Flash Player against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity: Critical9.8
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 93.89%
Remediation: Remediation guidance
Affected products: cpe adobe/flash player · cpe adobe/flash player desktop runtime · cpe opensuse/evergreen · cpe redhat/enterprise linux desktop · cpe redhat/enterprise linux server · cpe redhat/enterprise linux server eus

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe adobe/flash playerversion unspecified
cpe adobe/flash player desktop runtimeversion unspecified
cpe opensuse/evergreen11.4
cpe redhat/enterprise linux desktop5.0
cpe redhat/enterprise linux desktop6.0
cpe redhat/enterprise linux server5.0
cpe redhat/enterprise linux server6.0
cpe redhat/enterprise linux server eus6.6
vendor Adobe Flash Playerversion unspecified

How to fix CVE-2015-5122

Recommended remediation
The impacted product is end-of-life and should be disconnected if still in use. CISA due date May 4, 2022.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2015-5122 is in the CISA known-exploited catalog, due May 4, 2022. Confirm Adobe Flash Player against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with redhat/enterprise linux desktop 5.0; redhat/enterprise linux desktop 6.0; redhat/enterprise linux server 5.0; redhat/enterprise linux server 6.0. The impacted product is end-of-life and should be disconnected if still in use.

What should an analyst verify?

CWE-416: Use After Free. EPSS 93.89%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Jul 14, 2015 · Catalog
Detected
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti
Apr 13, 2022 · CISA KEV
Known exploited
The impacted product is end-of-life and should be disconnected if still in use.
May 4, 2022 · CISA KEV
Remediation due
The impacted product is end-of-life and should be disconnected if still in use.
Jun 16, 2026 · Catalog
Updated
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti

Sources

Apple Security ReleasesVendor advisoryCVE-2015-5122
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti
nvd.nist.gov
CISA KEVConfirmed exploitationCVE-2015-5122
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
cisa.gov
CVE.orgVulnerability recordCVE-2015-5122
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2015-5122
30-day exploitation probability 93.9%
first.org
Exploit DatabasePublic exploit reference37599
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit ModulesPublic exploit moduleexploit_multi/browser/adobe_flash_opaque_background_uaf
Public module reference (great). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2015-5122
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Li
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2015-5122
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

74/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability19/20
CVSS severity15/15
Public exploit10/10
Internet exposure0/10
Product prevalence0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS probability
93.89% · p99.85%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Jul 5, 2015. Ransomware use: Known.
Patch availability
Remediation guidance
The impacted product is end-of-life and should be disconnected if still in use.

Stacks

Adobe Flash

Weakness

CWE-416
Use After Free
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.