CVE-2015-8651: Adobe Flash Player Integer Overflow Vulnerability

Vulnerability summary

CVE-2015-8651 is a high (CVSS 9.3) Integer Overflow or Wraparound vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 25-05-2022. EPSS estimates a 67.70% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.

Timeline

1. 28-12-2015
   PublishedVulnerability first disclosed.
2. 25-05-2022
   Added to CISA KEVAdobe Flash Player Integer Overflow Vulnerability
3. 15-06-2022
   CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.