CVE-2015-3043: Adobe Flash Player Memory Corruption Vulnerability
Vulnerability summary
CVE-2015-3043 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 73.86% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 14-04-2015PublishedVulnerability first disclosed.
- 03-03-2022Added to CISA KEVAdobe Flash Player Memory Corruption Vulnerability
- 24-03-2022CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
- 17-11-2025Last modifiedVulnerability information updated.
Description
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
73.86%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 73.86% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2022
- Federal due date
- 24-03-2022
CISA required action
The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2015-3043
Public exploits
2 foundAdobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)
Maturity: weaponized
Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
exploit/multi/browser/adobe_flash_nellymoser_bof
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_eus6.6
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_server_aus6.6
- enterprise_linux_server_from_rhui5.0 | 6.0
Novell2 products
- suse_linux_enterprise_desktop11.0:sp3 | 12.0
- suse_linux_enterprise_workstation_extension12.0
Adobe1 product
- flash_player< 11.2.202.457 | < 13.0.0.281 | ≥ 14.0.0.125, < 17.0.0.169
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.457ubuntu0.14.04.1
5 vendors · 12 products
References
15 links- lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- helpx.adobe.com/security/products/flash-player/apsb15-06.htmlX Refsource CONFIRMBroken LinkPatchVendor AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 15 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3043Government ResourceUS Government Resource
- github.com/cisagov/vulnrichment/issues/196Issue Tracking