{"id":"CVE-2015-7645","published":"2015-10-15T10:59:10Z","modified":"2026-06-17T00:32:53Z","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":{"product":"Adobe Flash Player","since":"2020-12-31","note":"No security updates; remove it."},"description":{"text":"Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player contains an arbitrary code execution flaw affecting versions 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X, and 11.x through 11.2.202.535 on Linux. An attacker can execute arbitrary code by getting a victim to load a crafted SWF file, which requires no authentication but does require user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:07Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.65339,"percentile":0.99256,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-7645","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-10-13","exploitedFirstSeen":"2015-10-13","ransomware":true,"evidence":[{"url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/","date":"2015-10-13"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-10-13"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7645","date":"2015-10-15"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/teslacrypt-arrives-via-neutrino-exploit-kit/","date":"2016-03-15"},{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://unit42.paloaltonetworks.com/unit42-dealerschoice-sofacys-flash-player-exploit-platform/","date":"2016-10-17"},{"url":"https://www.oreilly.com/content/threat-intelligence-and-ransomware/","date":"2016-12-13"},{"url":"https://unit42.paloaltonetworks.com/unit42-let-ride-sofacy-groups-dealerschoice-attacks-continue/","date":"2016-12-15"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/terror-exploit-kit-more-like-error-exploit-kit/","date":"2017-01-09"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1913.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2024.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/77081","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1033850","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-05.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-27.html","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/201511-02","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/38490/","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00015.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00016.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1913.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2024.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/77081","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1033850","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-05.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-27.html","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/201511-02","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/38490/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7645","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by the user opening a maliciously-crafted .swf file.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"AN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2018-4878 (Zero-day vulnerability)\r\nCVE-2017-0199\r\nCVE-2015-2387\r\nCVE-2015-2545\r\nCVE-2015-7645","start":6997,"end":7317}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-7645","start":26500,"end":26513}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-7548","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-7548","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":38490,"url":"https://www.exploit-db.com/exploits/38490","title":"Adobe Flash - 'IExternalizable.writeExternal' Type Confusion","type":"dos","platform":"multiple","date":"2015-10-19","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-10-19"},"first":{"date":"2015-10-19","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/38490"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.html","https://www.exploit-db.com/exploits/38490/"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"}],"timeline":[{"date":"2015-10-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/","provenance":"source"},{"date":"2015-10-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7645","provenance":"source"},{"date":"2015-10-19","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-38490)","url":"https://www.exploit-db.com/exploits/38490","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-7548","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"Exploit-DB","daysToKev":2331},"priority":{"score":69.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4036 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9926"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]}}