CVE-2015-8435

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player for Windows and OS X before versions 18.0.0.268, 20.0.0.228, and 19.x before 20.0.0.228, as well as Linux Flash Player before 11.2.202.554, Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204 [1]. The flaw is triggered via unspecified vectors, likely involving crafted SWF content that causes the Flash Player to access already-freed memory [1].

Exploitation

An attacker would need to deliver a malicious SWF file to the target user, typically through a compromised website, email attachment, or malformed advertisement. No authentication or special network position beyond standard web browsing is required. The unsuspecting user would only need to load the crafted content in a web browser or AIR application that uses the vulnerable Flash Player.

Impact

Successful exploitation can lead to arbitrary code execution in the context of the affected process (the browser or AIR runtime) [1]. This could result in full system compromise, including installation of malware, data exfiltration, or further lateral movement within the target environment.

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), AIR 20.0.0.204, AIR SDK 20.0.0.204, and AIR SDK & Compiler 20.0.0.204 [1]. Users should upgrade immediately. As of the advisory, no workaround exists [1]. The vulnerability is not known to be listed on the CISA KEV.