CVE-2015-5119VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability

Affects Adobe Flash PlayerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/24/2022
EPSS: 98.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

nvd.nist.gov/vuln/detail/CVE-2015-5119 (opens in a new tab)

Description

CVE-2015-5119 is a use-after-free vulnerability in the ActionScript 3 ByteArray class of Adobe Flash Player that enables remote code execution by an attacker. This vulnerability has been exploited in the wild. It is classified as high severity due to its potential impact on system compromise.

Summary

This vulnerability involves a use-after-free condition in the ActionScript 3 ByteArray class within Adobe Flash Player. Exploitation allows remote attackers to execute arbitrary code on affected systems. The vulnerability has been observed in active exploitation campaigns, indicating real-world risk.

Impact

Successful exploitation can lead to remote code execution, allowing attackers to run arbitrary code with the privileges of the affected Flash Player process. This can result in system compromise or further malicious activity.

Mitigation

No patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Users should ensure they have applied the latest Adobe Flash Player updates if available and consider disabling or uninstalling Flash Player due to its end-of-life status.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:26:19 UTC

Weaknesses

References

Related threats