{"id":"CVE-2015-5119","published":"2015-07-08T14:59:05Z","modified":"2026-06-17T00:28:28Z","title":"Adobe Flash Player Use-After-Free Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":{"product":"Adobe Flash Player","since":"2020-12-31","note":"No security updates; remove it."},"description":{"text":"Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player has a use-after-free flaw in the ByteArray class of its ActionScript 3 implementation, affecting the 13.x through 13.0.0.296, 14.x through 18.0.0.194 and 11.x through 11.2.202.468 releases on Windows, OS X and Linux. A remote, unauthenticated attacker can exploit it without user interaction by supplying crafted Flash content that overrides a valueOf function, enabling arbitrary code execution or a denial of service through memory corruption.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:57:29Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98618,"percentile":0.99923,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-5119","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-07-05","exploitedFirstSeen":"2015-07-05","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-07-05"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5119","date":"2015-07-08"},{"url":"https://resources.infosecinstitute.com/topic/the-hacking-team-hack-when-hackers-have-become-the-target/","date":"2015-07-21"},{"url":"https://www.trendmicro.com/en_us/research/15/g/hacking-team-leak-uncovers-another-windows-zero-day-ms-releases-patch.html","date":"2015-07-21"},{"url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Aug.10.The_Italian_Connection_An_analysis_of_exploit_supply_chains_and_digital_quartermasters/HTExploitTelemetry.pdf","date":"2015-08-10"},{"url":"https://securelist.com/new-activity-of-the-blue-termite-apt/71876/","date":"2015-08-20"},{"url":"https://securelist.com/it-threat-evolution-in-q3-2015/72493/","date":"2015-11-02"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://freebeacon.com/wp-content/uploads/2016/02/Report_lowres.pdf","date":"2016-02-03"},{"url":"https://securityaffairs.co/wordpress/47741/cyber-crime/wekby-apt-malware.html","date":"2016-05-28"}],"evidenceTotal":27,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1214.html","tags":["Third Party Advisory"]},{"url":"http://twitter.com/w3bd3vil/statuses/618168863708962816","tags":["Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/561288","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uaf","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75568","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032809","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA15-195A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-03.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-16.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://packetstormsecurity.com/files/132600/Adobe-Flash-Player-ByteArray-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.gentoo.org/glsa/201507-13","tags":["Third Party Advisory"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1214.html","tags":["Third Party Advisory"]},{"url":"http://twitter.com/w3bd3vil/statuses/618168863708962816","tags":["Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/561288","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uaf","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75568","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032809","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA15-195A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-03.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-16.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://packetstormsecurity.com/files/132600/Adobe-Flash-Player-ByteArray-Use-After-Free.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.gentoo.org/glsa/201507-13","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5119","tags":["US Government Resource"]}],"techniques":[{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.","confidence":"high"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability has been exploited in the wild by multiple different threat actors.  Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.\n\nThese adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1566.002","name":"Spearphishing Link","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"primary_impact","evidence":[],"comment":"To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.","confidence":"high"},{"id":"T1055.001","name":"Dynamic-link Library Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability has been exploited in the wild by multiple different threat actors.  Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.\n\nThese adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors.","confidence":"high"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"secondary_impact","evidence":[],"comment":"To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.","confidence":"high"}],"reports":[{"id":"SRC-92352da397787b4045e8","title":"The Trail of BlackTech’s Cyber Espionage Campaigns","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22","mentions":[{"quote":"CVE-2015-5119, patched by Adobe last July, 2015","start":1967,"end":2014},{"quote":"PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.","start":2188,"end":2378}]},{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"C NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2013-4979\r\nCVE-2013-4979\r\nCVE-2015-5122\r\nCVE-2016-4117\r\nCVE-2014-8439\r\nCVE-2016-1019\r\nCVE-2015-5119","start":8856,"end":9176}]},{"id":"SRC-bc9af9dd604bcbbd89cd","title":"RECON MTL 2017 evolution of pirpi","publisher":"recon.cx","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf","date":null,"mentions":[{"quote":"• (CVE-2015-5119)","start":573,"end":590}]},{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":" SWF/Netis uses a critical vulnerability in Adobe Flash Player (CVE-2015-5119)","start":95551,"end":95630},{"quote":" SWF/Netis uses a critical vulnerability in Adobe Flash Player (CVE-2015-5119)","start":112642,"end":112721},{"quote":"An exploit that targets a vulnerability in Adobe Flash Player (CVE-\r\n2015-5119) to download and run files, including malware like","start":253554,"end":253683},{"quote":"56, 57, 58, 59\r\nCVE-2012-1889, 64\r\nCVE-2013-0074, 56\r\nCVE-2013-0422, 57, 59\r\nCVE-2013-1493, 56\r\nCVE-2013-2423, 56\r\nCVE-2013-2460, 56\r\nCVE-2013-2551, 56\r\nCVE-2013-3896, 56\r\nCVE-2014-1761, 62\r\nCVE-2014-6332, 61\r\nCVE-2015-0072, 64\r\nCVE-2015-0310, 56\r\nCVE-2015-0311, 56\r\nCVE-2015-0313, 56\r\nCVE-2015-5119, 54, 63,","start":261368,"end":261676}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-5119","start":26485,"end":26498}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-5134","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5134","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":37523,"url":"https://www.exploit-db.com/exploits/37523","title":"Adobe Flash Player - ByteArray Use-After-Free (Metasploit)","type":"remote","platform":"multiple","date":"2015-07-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-07-08"},"pocGithub":{"count":3,"skipped":0,"earliest":"2015-07-29","earliestUrl":"https://github.com/jvazquez-r7/CVE-2015-5119","repos":[{"name":"CiscoCXSecurity/CVE-2015-5119_walkthrough","url":"https://github.com/CiscoCXSecurity/CVE-2015-5119_walkthrough","stars":12,"created":"2015-09-10"},{"name":"jvazquez-r7/CVE-2015-5119","url":"https://github.com/jvazquez-r7/CVE-2015-5119","stars":11,"created":"2015-07-29"},{"name":"dangokyo/CVE-2015-5119","url":"https://github.com/dangokyo/CVE-2015-5119","stars":3,"created":"2018-08-21"}]},"metasploit":[{"name":"Adobe Flash Player ByteArray Use After Free","module":"exploit/multi/browser/adobe_flash_hacking_team_uaf","type":"exploit","disclosureDate":"2015-07-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb"}],"first":{"date":"2015-07-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb"},"provenance":"source"},"exploitRefs":["https://packetstormsecurity.com/files/132600/Adobe-Flash-Player-ByteArray-Use-After-Free.html"],"flow":[{"stage":"exploitation","techniques":["T1566.002","T1059.007"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1055.001","T1071.001"],"provenance":"source"},{"stage":"related","techniques":["T1203","T1204.001"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-07-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-07-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-07-08, PoC-in-GitHub 2015-07-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb","provenance":"source"},{"date":"2015-07-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5119","provenance":"source"},{"date":"2017-06-22","kind":"report","label":"Named in trendmicro.com: The Trail of BlackTech’s Cyber Espionage Campaigns","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","provenance":"machine"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5134","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2430},"priority":{"score":74.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4134 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 3 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-adobe-flash-player-cwe-416"}}