CVE-2015-8646

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player prior to version 18.0.0.324 on Windows and OS X, versions 19.x and 20.x prior to 20.0.0.267, and version 11.2.202.559 on Linux. Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 are also affected [1][2]. The vulnerability can be triggered via unspecified vectors, typically involving crafted SWF content that corrupts object memory [1].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious SWF file on a website or through a drive-by download, requiring only that a user visits the compromised page with an affected Flash Player. No authentication or prior access is needed. The use-after-free condition allows the attacker to manipulate memory and eventually gain control of execution flow [2].

Impact

Successful exploitation results in arbitrary code execution in the context of the browser plugin or standalone Flash Player instance. Depending on user privileges, this can lead to full system compromise, including data theft, installation of malware, and further network propagation [1][2].

Mitigation

Adobe released fixed versions on December 28, 2015: Flash Player 20.0.0.267 (Windows/OS X), 11.2.202.559 (Linux), and AIR 20.0.0.233 [1][2]. Red Hat and Gentoo advisories recommend immediate updates via respective package managers [1][2]. No workaround is available; the only mitigation is applying the latest patches.