CVE-2015-5561

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 [1][2]. The bug is triggered via unspecified vectors, allowing an attacker to reference freed memory in the Flash rendering engine.

Exploitation

An attacker can exploit this remotely by enticing a user to visit a malicious web page or open a crafted SWF file. No authentication or special network position is required; the victim's browser or application must have an affected Flash Player version installed [1][2]. The exploit sequence involves supplying a malformed Flash object that triggers the use-after-free condition.

Impact

Successful exploitation allows arbitrary code execution in the context of the affected Flash Player process. The attacker could gain full control of the user's system, including reading sensitive information, modifying data, or installing malware [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux) alongside AIR 18.0.0.199 [1]. Red Hat and Gentoo advisories confirm these updates are available [1][2]. Users should update immediately; no workaround is known [2].