VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 22, 2015· Updated May 6, 2026

CVE-2015-5578

CVE-2015-5578

Description

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Memory corruption in Adobe Flash Player prior to specific versions allows arbitrary code execution or denial of service via crafted SWF content.

Vulnerability

CVE-2015-5578 is a memory corruption vulnerability affecting Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X, and before 11.2.202.521 on Linux. It also affects Adobe AIR before 19.0.0.190, the AIR SDK before 19.0.0.190, and the AIR SDK & Compiler before 19.0.0.190 [1][2]. The flaw is triggered via unspecified vectors, likely involving malicious SWF files, and does not require any special configuration beyond having a vulnerable Flash version installed.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file and hosting it on a website or embedding it in an email. The victim must open the content in a browser or application using the affected Flash Player or AIR runtime. No additional privileges or system access are needed. The exact exploitation sequence is not detailed in public references, but standard memory corruption exploitation techniques apply [1][2].

Impact

Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the Flash process (typically the user's account) or cause a denial of service (application crash). This can lead to remote code execution, complete system compromise, or disruption of service, depending on the target environment [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.241 (Windows/OS X), 19.0.0.185 (Windows/OS X), and 11.2.202.521 (Linux); AIR 19.0.0.190 and associated SDKs on 2015-09-21. Red Hat [1] and Gentoo [2] have issued updates for their respective distributions. Users should update to these versions or later. No workarounds are known. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. http://rhn.redhat.com/errata/RHSA-2015-1814.html
  2. Multiple vulnerabilities (GLSA 201509-07) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

35
  • Adobe Inc./Air2 versions
    cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*range: <=18.0.0.143
    • (no CPE)range: < 19.0.0.190
  • Adobe Inc./Air Sdk
    cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
    Range: <=18.0.0.199
  • Adobe Inc./Air Sdk \& Compiler
    cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
    Range: <=18.0.0.180
  • Adobe Inc./Flashplayer25 versions
    cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*+ 24 more
    • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*range: <=11.2.202.508
    • cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:17.0.0.188:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:17.0.0.190:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:17.0.0.191:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:18.0.0.160:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:18.0.0.194:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:18.0.0.203:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:18.0.0.209:*:*:*:*:*:*:*
    • cpe:2.3:a:adobe:flash_player:18.0.0.232:*:*:*:*:*:*:*
  • Google/Android
    cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
  • Adobe Inc./Flash Playerllm-fuzzy
    Range: < 18.0.0.241 or 19.x < 19.0.0.185 (Windows/OS X) or < 11.2.202.521 (Linux)
  • osv-coords4 versions
    pkg:rpm/suse/flash-player&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3pkg:rpm/suse/flash-player&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4pkg:rpm/suse/flash-player&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/flash-player&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012
    < 11.2.202.521-0.17.1+ 3 more
    • (no CPE)range: < 11.2.202.521-0.17.1
    • (no CPE)range: < 11.2.202.521-0.17.1
    • (no CPE)range: < 11.2.202.521-102.1
    • (no CPE)range: < 11.2.202.521-102.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.