VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 10, 2015· Updated May 6, 2026

CVE-2015-8405

CVE-2015-8405

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Adobe Flash Player allows remote code execution via unspecified vectors; fixed in versions 18.0.0.268, 20.0.0.228, and 11.2.202.554.

Vulnerability

CVE-2015-8405 is a use-after-free vulnerability in Adobe Flash Player affecting versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. It also affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The vulnerability can be triggered via unspecified vectors, likely involving crafted SWF content [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious SWF file or visit a web page hosting the crafted content. No authentication is required, and the attack can be performed remotely. The exact exploitation steps are not publicly disclosed, but the use-after-free condition allows the attacker to corrupt memory and achieve code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This can lead to full compromise of the user's system, including data theft, installation of malware, or further network propagation. The impact is rated as critical with a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268, 20.0.0.228 (Windows/OS X), and 11.2.202.554 (Linux); AIR 20.0.0.204. Users should upgrade immediately. For Gentoo Linux, the fixed version is 11.2.202.559 [1]. No workaround is available. This vulnerability is not listed in the KEV catalog as of the publication date.

References
  1. Multiple vulnerabilities (GLSA 201601-03) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

16

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.