CVE-2015-5122
Adobe Flash Player Use-After-Free Vulnerability
Description
CVE-2015-5122 is a use-after-free vulnerability in Adobe Flash Player that enables remote code execution through specially crafted Flash content delivered via web browsers. Like CVE-2015-5123, this vulnerability was discovered in the Hacking Team data breach and was actively exploited as a zero-day. CISA has added CVE-2015-5122 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 97.3% (99.9th percentile), it ranks among the most exploited software vulnerabilities globally, having been integrated into numerous exploit kits and targeted attack campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | >= 13.0, <= 13.0.0.302; >= 18.0, <= 18.0.0.203; >= 18.0, <= 18.0.0.204; >= 11.0, <= 11.2.202.481 |
| adobe | flash player desktop runtime | >= 18.0, <= 18.0.0.203 |
| redhat | enterprise linux desktop | 5.0; 6.0 |
| redhat | enterprise linux server | 5.0; 6.0 |
| redhat | enterprise linux server eus | 6.6 |
| redhat | enterprise linux workstation | 5.0; 6.0 |
| opensuse | evergreen | 11.4 |
| suse | linux enterprise desktop | 11; 12 |
| suse | linux enterprise workstation extension | 12 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=144050155601375&w=2(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://rhn.redhat.com/errata/RHSA-2015-1235.html(Third Party Advisory)
- http://www.kb.cert.org/vuls/id/338736(Third Party Advisory, US Government Resource)
- http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf(Third Party Advisory)
- http://www.securityfocus.com/bid/75712(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032890(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/ncas/alerts/TA15-195A(Third Party Advisory, US Government Resource)
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784(Broken Link, Third Party Advisory)
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467(Third Party Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsa15-04.html(Broken Link, Vendor Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsb15-18.html(Broken Link, Vendor Advisory)
- https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/(Broken Link, Third Party Advisory)
- https://perception-point.io/new/breaking-cfi.php(Broken Link, Third Party Advisory)
- https://security.gentoo.org/glsa/201508-01(Third Party Advisory)
- https://www.exploit-db.com/exploits/37599/(Exploit, Third Party Advisory, VDB Entry)
- https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html(Broken Link, Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/196(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a weakness where software accesses memory after it has been freed, which can lead to arbitrary code execution. In CVE-2015-5122, Adobe Flash Player references freed memory in the opaqueBackground property handler, allowing an attacker to control the reallocated memory contents and redirect execution to arbitrary code.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2015-5122 provides full remote code execution through the browser with no user interaction required beyond visiting a malicious web page. The confidentiality, integrity, and availability of the target system are all completely compromised, as the attacker gains code execution at the browser process privilege level. Exploitation through malvertising networks enabled mass compromise of users across legitimate websites, and the vulnerability's use by the Hacking Team for targeted surveillance demonstrates its effectiveness against high-value targets. The zero-click exploitation through normal web browsing made this vulnerability one of the most dangerous attack vectors in the Flash Player era.
Exploit Maturity
CVE-2015-5122 was weaponized as a zero-day exploit before any patch was available, discovered in the Hacking Team data leak of July 2015. The EPSS score of 97.3% (99.9th percentile) confirms near-certain exploitation probability. Multiple major exploit kits including Angler, Magnitude, and Nuclear rapidly integrated this vulnerability, and it remained a top exploitation vector for years. The pre-patch exploitation by a surveillance company and immediate adoption by cybercriminal exploit kits represents the most dangerous maturity profile possible.
Remediation
- Remove Adobe Flash Player entirely as required by CISA KEV — Flash Player reached end of life on December 31, 2020.
- Verify complete removal of Flash Player from all endpoints and servers, including browser plugin versions.
- Block Flash content at the network perimeter and in browser configurations to prevent residual exposure.
- For legacy Flash dependencies, isolate applications in sandboxed environments with no access to sensitive resources.
- Scan systems that previously ran Flash Player for persistent threats that may have been established through exploitation.
Technical Details
CVE-2015-5122 is a use-after-free vulnerability in Adobe Flash Player's handling of the opaqueBackground property. When crafted ActionScript triggers specific operations on DisplayObject instances, the Flash Player frees memory associated with the opaqueBackground value but fails to nullify the reference. Subsequent access to this dangling pointer allows the attacker to corrupt heap metadata and gain control over program execution flow. The vulnerability is exploitable through embedded SWF content in web pages and requires no user interaction beyond page rendering. Combined with heap grooming techniques, attackers achieve reliable code execution across different Flash Player versions and operating systems.
Frequently Asked Questions
Is CVE-2015-5122 being actively exploited?
Yes. CVE-2015-5122 was exploited as a zero-day and subsequently integrated into multiple exploit kits. It is listed in the CISA KEV catalog with a 99.9th percentile EPSS score.
What products are affected by CVE-2015-5122?
CVE-2015-5122 affects Adobe Flash Player across Windows, macOS, and Linux platforms. Flash Player is end-of-life and should be completely removed.
How do I fix CVE-2015-5122?
Remove Adobe Flash Player entirely from all systems. There are no supported patches as Flash Player has been discontinued. Block all Flash content in browsers and at network perimeters.
How severe is CVE-2015-5122?
CVE-2015-5122 is a critical remote code execution vulnerability exploited as a zero-day by a surveillance company and mass-exploited through criminal exploit kits. Its EPSS score in the 99.9th percentile confirms it as one of the most dangerous Flash Player vulnerabilities ever discovered.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.