VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 10, 2015· Updated May 6, 2026

CVE-2015-8057

CVE-2015-8057

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Adobe Flash Player before 18.0.0.268/20.0.0.228/11.2.202.554 allows remote code execution via unspecified vectors.

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.268 on Windows and OS X, 20.0.0.228 for 19.x and 20.x, and 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204 and related SDKs. The flaw occurs when the application improperly handles memory after it has been freed, allowing an attacker to corrupt memory. The exact code path is triggered via unspecified vectors, likely involving crafted SWF content.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious Flash file or visit a web page hosting the crafted SWF. No additional authentication or network position beyond delivering the content is required. The use-after-free condition leads to memory corruption that can be leveraged to execute arbitrary code.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This can lead to full system compromise, including data theft, installation of malware, or further lateral movement. The vulnerability is part of a large batch of Flash Player issues disclosed in December 2015 [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268 and 20.0.0.228 for Windows/OS X, 11.2.202.554 for Linux, and AIR 20.0.0.204. Gentoo Linux recommends upgrading to 11.2.202.559 [1]. No workaround is available; users should update immediately.

References
  1. Multiple vulnerabilities (GLSA 201601-03) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

17

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.