CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability
Vulnerability summary
CVE-2015-0311 is a high (CVSS 10.0) vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 13-04-2022. EPSS estimates a 85.59% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 23-01-2015PublishedVulnerability first disclosed.
- 13-04-2022Added to CISA KEVAdobe Flash Player Remote Code Execution Vulnerability
- 04-05-2022CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
- 17-11-2025Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
85.59%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
-0.23 pp
From 85.82% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 13-04-2022
- Federal due date
- 04-05-2022
CISA required action
The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2015-0311
Public exploits
2 foundAdobe Flash Player - ByteArray UncompressViaZlibVariant Use-After-Free (Metasploit)
Maturity: weaponized
Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free
exploit/multi/browser/adobe_flash_uncompress_zlib_uaf
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft2 products
- edgena
- internet_explorerEOL10 | 11
Suse2 products
Adobe1 product
- flash_player≤ 11.2.202.438 | ≤ 13.0.0.262 | ≥ 14.0.0.125, < 16.0.0.287
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.429ubuntu0.14.04.1
4 vendors · 6 products
References
19 links- lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 19 references
- lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- helpx.adobe.com/security/products/flash-player/apsa15-01.htmlX Refsource CONFIRMVendor AdvisoryREPORT
- malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.htmlX Refsource MISCThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0311Government ResourceUS Government Resource
- github.com/cisagov/vulnrichment/issues/196Issue Tracking