Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Adobe Flash Player and AIR can run malicious code

CVE-2015-8649 · published 10 years ago
Summary

Versions of Adobe Flash Player, Adobe AIR, and the AIR SDK before their latest updates may let an attacker cause the program to use memory that has already been released, which can lead to the execution of unwanted code. This could allow a malicious party to take control of the affected system. Update all Adobe Flash Player and AIR products to the latest versions as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 18.0.0.268
19.0.0.185
19.0.0.207
19.0.0.226
19.0.0.245
20.0.0.228
20.0.0.235
<= 11.2.202.554
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe air_sdk <= 20.0.0.204
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 20.0.0.204
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
adobe air <= 20.0.0.204
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR...
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, and CVE-2015-8650.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
7% chance of attack within 30 days
Timeline
Published28 Dec 2015
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-8649 · NVD
Track software like this
Free during beta