CVE-2015-8457

Vulnerability

A stack-based buffer overflow exists in Adobe Flash Player's handling of HTTP Live Streaming (HLS). The vulnerability stems from a failure to validate the size of a user-supplied buffer before copying it to a stack buffer [1]. Affected versions include Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 are also affected.

Exploitation

Exploitation requires user interaction: the target must visit a malicious web page or open a malicious file [1]. The attacker does not need prior authentication or special network position beyond serving the crafted content. The specific flaw is triggered during HLS stream processing, where a stack buffer is overflowed due to insufficient size validation.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process [1]. This typically results in full compromise of the user's system, including the ability to install programs, view, change, or delete data, and create new accounts with full user rights.

Mitigation

Adobe released fixed versions on December 10, 2015: Flash Player 20.0.0.228 (and 18.0.0.268 for older branches), AIR 20.0.0.204, and corresponding SDK updates. Users should update to these versions immediately. No workarounds are documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.