CVE-2015-8641

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.324, 19.x and 20.x before 20.0.0.267 on Windows and macOS, and before 11.2.202.559 on Linux; Adobe AIR before 20.0.0.233; and Adobe AIR SDK (including SDK & Compiler) before 20.0.0.233. The flaw is triggered via unspecified vectors, meaning crafted SWF content can cause a dangling pointer reference after the object is freed. This is part of a cluster of similar use-after-free issues (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650). [1][2]

Exploitation

Attackers can exploit this vulnerability by delivering a maliciously crafted Flash file (e.g., via a compromised website, malvertising, or email attachment) that triggers the use-after-free condition when parsed by an affected version. No authentication or prior access is required; the attack is remote and can be launched through a web browser or any application that renders Flash content. The user only needs to open the malicious content. [1][2]

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This can lead to full system compromise, including installation of malware, data theft, denial of service, or bypass of security restrictions. The CVSS v3 score is 8.8, reflecting high severity. [1][2]

Mitigation

Adobe released fixed versions on December 28, 2015: Flash Player 20.0.0.267 for Windows/macOS and 11.2.202.559 for Linux, as well as AIR 20.0.0.233 and corresponding SDK updates. Users should update immediately via the official Adobe download center or the built-in update mechanism. Red Hat and Gentoo issued advisories urging upgrades. No workaround is available. [1][2]