CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
Description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Affected products
adobe: flash player; apple: mac os x; microsoft: windows; linux: linux kernel; opensuse: evergreen; opensuse: opensuse; suse: linux enterprise desktop; suse: linux enterprise workstation extension; hp: insight orchestration; hp: system management homepage; hp: systems insight manager; hp: version control agent; hp: version control repository manager; hp: virtual connect enterprise manager; redhat: enterprise linux desktop
References10
- helpx.adobe.com/security/products/flash-player/apsb15-14.html Broken LinkPatchVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb15-14.html Broken LinkPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.… Mailing ListThird Party Advisory
- marc.info/?l=bugtraq&m=144050155601375&w=2 Mailing List
- rhn.redhat.com/errata/RHSA-2015-1184.html Third Party Advisory
- www.securityfocus.com/bid/75371 Broken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1032696 Broken LinkThird Party AdvisoryVDB Entry
- bugzilla.redhat.com/show_bug.cgi?id=1235036 Issue Tracking
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 2 November 2026
- CWE
- CWE-787CWE-122