Adobe Flash Player Arbitrary Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2015 · Catalog

   Detected

   Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

2. Mar 3, 2022 · CISA KEV

   Known exploited

   The impacted product is end-of-life and should be disconnected if still in use.

3. Mar 24, 2022 · CISA KEV

   Remediation due

   The impacted product is end-of-life and should be disconnected if still in use.

4. Jun 16, 2026 · Catalog

   Updated

   Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

Affected

• cpe adobe/flash playerversion unspecified
• cpe adobe/flash player19.0.0.185
• cpe adobe/flash player19.0.0.207
• cpe opensuse/evergreen11.4
• cpe opensuse/opensuse13.1
• cpe opensuse/opensuse13.2
• cpe redhat/enterprise linux desktop5.0
• cpe suse/linux enterprise desktop11
• vendor Adobe Flash Playerversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2015-7645

  Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.

  cisa.gov
• CVE.orgVulnerability recordCVE-2015-7645

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2015-7645

  30-day exploitation probability 65.3%

  first.org
• Exploit DatabasePublic exploit reference38490

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2015-7645

  Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Broken Link · blog.trendmicro.com
• Mailing List · lists.opensuse.org
• Mailing List · lists.opensuse.org
• Mailing List · lists.opensuse.org
• Mailing List · lists.opensuse.org
• Third Party Advisory · packetstormsecurity.com
• Broken Link · helpx.adobe.com
• CISA note · nvd.nist.gov