CVE-2015-8650

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.324, 19.x and 20.x before 20.0.0.267 on Windows and OS X, and before 11.2.202.559 on Linux. Affected products also include Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 [1][2]. The flaw allows attackers to execute arbitrary code via unspecified vectors, making it critical for exploitation.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted Flash file (SWF) through a web page or other vector. No authentication is required, and the attack can be launched remotely. The user must interact with the crafted content, but no special privileges or complex conditions are needed beyond having the vulnerable Flash Player installed [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected user. This can lead to full system compromise, including data theft, installation of malware, or further network propagation. The vulnerability is rated as High severity with a CVSS v3 base score of 8.8, indicating significant impact on confidentiality, integrity, and availability [1][2].

Mitigation

Adobe released patched versions: 20.0.0.267 for Windows/OS X, 18.0.0.324 for older branches, and 11.2.202.559 for Linux. Adobe AIR was fixed in version 20.0.0.233. Red Hat and Gentoo have released advisories urging immediate update [1][2]. No workaround is available; users must upgrade to the latest versions to mitigate the risk. The vulnerability is not currently listed in the CISA KEV.