CVE-2015-7645 KEVRansomwarePublic exploitEnd of life High · 7.8 EPSS 65.3%

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe · Flash Player

End of lifeAdobe Flash Player reached on 31 Dec 2020. No patch is coming: remove or isolate it.

Summary

Adobe Flash Player contains an arbitrary code execution flaw affecting versions 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X, and 11.x through 11.2.202.535 on Linux. An attacker can execute arbitrary code by getting a victim to load a crafted SWF file, which requires no authentication but does require user interaction.

Official description · NVD

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

Breakdown

69.4 / 100

Exploited: Yes, in CISA KEV
Reports: 2
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Trick a user into opening a fileT1204.002 · Malicious FileSource dataMedium confidence39 general detection rules

First seen exploited 2 days before it was disclosed. Public exploit code (Exploit-DB) appeared 4 days after disclosure.

First seen exploitedVulnCheck KEV evidence13 Oct 20152 days before
Disclosed15 Oct 2015day 0
Public exploit codeExploit-DB19 Oct 2015+4 days
Added to CISA KEVknown ransomware use; EU database agrees3 Mar 2022+6 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order 1

ExecutionTA0002

Malicious File T1204.002 Medium

MITRE CTID mapping of the KEV entry · how it is exploited

This vulnerability is exploited by the user opening a maliciously-crafted .swf file.

Detection

0 rules for this CVE · 39 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-7645 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports

2 reportsservices.google.comMicrosoft

Reports are matched by finding the exact id CVE-2015-7645 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

services.google.comUndated

The Overlooked North Korean Actor

AN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2018-4878 (Zero-day vulnerability) CVE-2017-0199 CVE-2015-2387 CVE-2015-2545 CVE-2015-7645…

Original (opens in a new tab) ↗

MicrosoftUndated

Microsoft Security

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

15 links, grouped by NVD tag (14 duplicates merged)

Show 3 moreShow fewer

securitytracker.com/id/1033850 security.gentoo.org/glsa/201511-02 exploit-db.com/exploits/38490/

Broken Link 2

blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/helpx.adobe.com/security/products/flash-player/apsb15-27.html

Exploitation evidence

Exploited in the wild

Listed since 3 Mar 2022. Federal due date 24 Mar 2022. Known ransomware use.

The impacted product is end-of-life and should be disconnected if still in use.

ENISA

Marked exploited since 3 Mar 2022. EUVD-2015-7548

Adobe Flash - 'IExternalizable.writeExternal' Type ConfusionEDB-38490 · dos · multiple · 2015-10-19 · verified

, 30 Oct 2026

65.3%Top 0.74%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.26%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 4036 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9926 19.9/20

Threat reports2 reports 6.1/10

Public exploit code1 Exploit-DB entry; 2 NVD exploit links 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productNo patches exist; remove or isolate it −15.0

Total69.4

Record

Published: 15 Oct 2015
Modified: 17 Jun 2026
: None assigned
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques