Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR could let attackers run code

CVE-2015-5541 · published 11 years ago
Summary

Older versions of Adobe Flash Player, Adobe AIR, and the AIR development tools can be tricked into running malicious code. This could allow a hacker to take control of a computer that uses the vulnerable software. Update to the latest versions of Flash Player and AIR to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 11.2.202.491
<= 18.0.0.209
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe air <= 18.0.0.180
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
adobe air_sdk <= 18.0.0.180
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 18.0.0.180
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR ...
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5129.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
11% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published14 Aug 2015
Updated16 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-5541 · NVD
Track software like this
Free during beta