VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 10, 2015· Updated May 6, 2026

CVE-2015-8414

CVE-2015-8414

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Adobe Flash Player before 18.0.0.268, 20.0.0.228, and 11.2.202.554 allows remote attackers to execute arbitrary code.

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.268 on Windows and OS X, 20.x prior to 20.0.0.228 on Windows and OS X, and 11.x prior to 11.2.202.554 on Linux, as well as in Adobe AIR and AIR SDK/Compiler before 20.0.0.204. The flaw is triggered via unspecified vectors, allowing memory corruption when an object is accessed after it has been freed. The vulnerability is distinct from other similar CVEs listed in the advisory [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a malicious webpage or open a crafted SWF file. No authentication or special privileges are required. The unspecified vectors likely involve crafted content that triggers the use-after-free condition, leading to controlled memory corruption [1].

Impact

Successful exploitation allows arbitrary code execution with the privileges of the affected user process. This can lead to full compromise of the system, including data theft, installation of malware, or further lateral movement [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268, 20.0.0.228, and 11.2.202.559 (for Linux), and Adobe AIR 20.0.0.204. Users should upgrade immediately. Gentoo Linux users can update via the provided emerge command [1]. No workarounds are available for unpatched versions [1]. This CVE is not listed in the KEV catalog as of 2015-12-10.

References
  1. Multiple vulnerabilities (GLSA 201601-03) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

17

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.