VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 10, 2015· Updated May 6, 2026

CVE-2015-8450

CVE-2015-8450

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted filters property value in a TextField object, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8452, and CVE-2015-8454.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Adobe Flash Player use-after-free in TextField filters allows remote code execution via crafted SWF.

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField object when manipulating the filters property. This affects Flash Player versions before 18.0.0.268 (Windows/OS X), 19.x and 20.x before 20.0.0.228 (Windows/OS X), and 11.x before 11.2.202.554 (Linux), as well as Adobe AIR before 20.0.0.204 [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a malicious web page or open a crafted SWF file. No authentication is required. The specific flaw involves setting the filters property such that a dangling pointer is reused after being freed, leading to arbitrary code execution under the context of the current process [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This can lead to complete compromise of the affected system, including data theft, malware installation, or further lateral movement [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 18.0.0.268 (Windows/OS X), and 11.2.202.559 (Linux); Adobe AIR 20.0.0.204. Users should update immediately via the official Adobe update mechanism or package manager (e.g., Gentoo's >=www-plugins/adobe-flash-11.2.202.559 [2]). No workarounds are available.

References
  1. ZDI-15-613
  2. Multiple vulnerabilities (GLSA 201601-03) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

17

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.