Vulnerability record

CVE-2015-5122

Adobe Flash Player Use-After-Free Vulnerability

CriticalExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Flash Player, fix it now.

CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

US federal civilian agencies must remediate by May 4, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Flash Player	Adobe	>= 13.0, <= 13.0.0.302; >= 18.0, <= 18.0.0.203; >= 18.0, <= 18.0.0.204; >= 11.0, <= 11.2.202.481	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2015-5122 scored CVSS 9.8: Adobe Flash Player, Adobe Flash Player Use-After-Free Vulnerability
CISA lists this as exploited in the wild. Unpatched Flash Player systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2015-5122
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html
marc.info http://marc.info/?l=bugtraq&m=144050155601375&w=2
packetstormsecurity.com http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html
rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1235.html
kb.cert.org http://www.kb.cert.org/vuls/id/338736
rapid7.com http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf
securityfocus.com http://www.securityfocus.com/bid/75712
securitytracker.com http://www.securitytracker.com/id/1032890
us-cert.gov http://www.us-cert.gov/ncas/alerts/TA15-195A
h20564.www2.hp.com https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784
h20564.www2.hpe.com https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467
helpx.adobe.com https://helpx.adobe.com/security/products/flash-player/apsa15-04.html
helpx.adobe.com https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
perception-point.io https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/
perception-point.io https://perception-point.io/new/breaking-cfi.php
security.gentoo.org https://security.gentoo.org/glsa/201508-01
exploit-db.com https://www.exploit-db.com/exploits/37599/
fireeye.com https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html
github.com https://github.com/cisagov/vulnrichment/issues/196
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122