{"id":"CVE-2015-3043","published":"2015-04-14T22:59:21Z","modified":"2026-06-17T00:25:10Z","title":"Adobe Flash Player Memory Corruption Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":{"product":"Adobe Flash Player","since":"2020-12-31","note":"No security updates; remove it."},"description":{"text":"Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player contains a memory corruption flaw, classed as an out-of-bounds write, in its core player component. An attacker can run arbitrary code or crash the player over the network with no authentication or user interaction required, using unspecified attack vectors.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:02Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.73862,"percentile":0.99476,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-3043","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-04-13","exploitedFirstSeen":"2015-04-13","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-04-13"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3043","date":"2015-04-14"},{"url":"https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html","date":"2015-04-18"},{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf","date":"2018-02-04"},{"url":"https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/","date":"2019-12-05"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_APT_28_4856c0a0ac.pdf","date":"2023-02-05"},{"url":"https://www.logpoint.com/wp-content/uploads/2024/06/logpoint-etpr-forest-blizzard.pdf","date":"2024-05-31"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0813.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/74062","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032105","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-06.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201504-07","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37536/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0813.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/74062","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032105","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-06.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201504-07","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37536/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3043","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Corruption","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system via drive-by compromise.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Corruption","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Corruption","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system.","confidence":"high"}],"reports":[{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"2016-1019 and CVE-2015-3043 were all exploited","start":8066,"end":8112}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-3043","start":26470,"end":26483},{"quote":" The exploit targeting CVE-2015-3043, a vulnerability in Adobe Flash","start":41363,"end":41432},{"quote":"Snippet from the STRONTIUM ActionScript exploit code targeting CVE-2015-3043 in Adobe Flash","start":41917,"end":42008},{"quote":"MS15-022\r\nCVE-2015-1641 Word RTF Microsoft Word MS15-033\r\nCVE-2015-1701 Win32k EoP Microsoft Windows MS15-051\r\nCVE-2015-1769 USB vector Microsoft Windows MS15-085\r\nCVE-2015-1770 Word OSF Microsoft Word MS15-059\r\nCVE-2015-2360 Win32k EoP Microsoft Windows MS15-061\r\nCVE-2015-3043 Flash codec Adobe Flash Player","start":98548,"end":98857},{"quote":"46, 53\r\nCVE-2015-0097, 57\r\nCVE-2015-0310, 47\r\nCVE-2015-0311, 46, 47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47, 53\r\nCVE-2015-1641, 16, 57\r\nCVE-2015-1701, 14, 18, 19, 57\r\nCVE-2015-1769, 57\r\nCVE-2015-1770, 57\r\nCVE-2015-2360, 57\r\nCVE-2015-2424, 16, 17\r\nCVE-2015-3043, 17, 18,","start":238370,"end":238672}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-3124","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3124","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":37536,"url":"https://www.exploit-db.com/exploits/37536","title":"Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)","type":"remote","platform":"multiple","date":"2015-07-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-07-08"},"metasploit":[{"name":"Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow","module":"exploit/multi/browser/adobe_flash_nellymoser_bof","type":"exploit","disclosureDate":"2015-06-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb"}],"first":{"date":"2015-06-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/37536/"],"flow":[{"stage":"primary","techniques":["T1499.004"],"provenance":"source"},{"stage":"related","techniques":["T1189","T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-04-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-04-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3043","provenance":"source"},{"date":"2015-06-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-07-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3124","provenance":"source"}],"speed":{"daysToPublicExploit":70,"firstExploitFrom":"Metasploit","daysToKev":2515},"priority":{"score":60.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4217 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9948"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-adobe-flash-player-cwe-787"}}