CVE-2015-3118

published 2015-07-09

CVE-2015-3118: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on…

Priority P2 64 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 18.0.0.144	—
adobe	air_sdk	<= 18.0.0.144	—
adobe	air_sdk_compiler	<= 18.0.0.144	—
adobe	flash_player	<= 11.2.202.468	—
adobe	flash_player	<= 13.0.0.289	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37848.zip↗

filename flash_as2_filters_uaf_write4_poc.swf↗

filename flash_as2_filters_uaf_write4.swf↗

• → The vulnerability is triggered by setting a TextField's `filters` property to a custom AS2 object (not a plain Array) with an overridden `length` property (via `valueOf`). Monitor for SWF files using AS2 `textfield.filters` assignment with non-Array objects containing a custom `valueOf` on the length property. ↗
• → The exploit pattern involves creating a TextField at a specific depth, assigning filters, then immediately recreating a DisplayObject at the same depth to free the underlying object — triggering use-after-free. Detect SWFs that call `createTextField` at the same depth twice in rapid succession after a `filters` assignment. ↗
• → The PoC uses heap spray with arrays filled with 0x41424344 and controlled offsets (0x3F8, 0x324) to achieve a write-4 primitive. Detect Flash heap spray patterns with large arrays of repeated DWORD values such as 0x41424344 in AS2 context. ↗
• → The vulnerability affects Flash Player 17.0.0.169 (and versions before 18.0.0.203 on Windows/OS X, before 11.2.202.481 on Linux). Flag processes running outdated Flash Player versions in this range. ↗

• · The CVE-2015-3118 use-after-free is described as triggered via 'unspecified vectors' in the NVD entry; the exploit-db PoC (37848) specifically demonstrates the AS2 textfield.filters path, but other attack vectors for the same CVE may exist. ↗
• · The PoC SWF files (flash_as2_filters_uaf_write4_poc.fla / .swf) require manual compilation with Flash CS5.5 and a property rename from 's' to '3' post-compile, meaning raw .fla source alone is not directly weaponized. ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.