CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

Vulnerability summary

CVE-2015-3113 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 13-04-2022. EPSS estimates a 99.81% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 23-06-2015
   PublishedVulnerability first disclosed.
2. 13-04-2022
   Added to CISA KEVAdobe Flash Player Heap-Based Buffer Overflow Vulnerability
3. 04-05-2022
   CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
4. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().