Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Adobe Flash Player/AIR can run code from crafted video

CVE-2015-8653 · published 10 years ago
Summary

Versions of Adobe Flash Player, Adobe AIR, and related runtimes on Windows, macOS, and Linux can be tricked by specially crafted MPEG‑4 video files to run any code the attacker chooses. This could let attackers take control of the affected system or steal data. Update to the latest releases of Flash Player and AIR or remove them if they are no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 11.2.202.548
<= 18.0.0.261
<= 19.0.0.245
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe flash_player_desktop_runtime <= 19.0.0.245
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
adobe air_desktop_runtime <= 19.0.0.241
cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*
adobe air_sdk <= 19.0.0.241
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 19.0.0.241
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
adobe air <= 19.0.0.241
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR...
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
8% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published4 Mar 2016
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-8653 · NVD
Track software like this
Free during beta