CVE-2015-5546: Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and…

PriorityP265critical10CVSS 2.0

AVNACLAuNCCICAC

EXPLOIT

EPSS

38.17%

98.4th percentile

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 18.0.0.180	—
adobe	air_sdk	<= 18.0.0.180	—
adobe	air_sdk_compiler	<= 18.0.0.180	—
adobe	flash_player	<= 11.2.202.491	—
adobe	flash_player	<= 18.0.0.209	—

Detection & IOCsextracted from sources · hover to see the quote

hash268381c02bc3b05c84578ebaeafc02f0↗

filenamesignal_sigsegv_7ffff603deef_1525_268381c02bc3b05c84578ebaeafc02f0.swf↗

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37868.zip↗

→Crash/bad dereference at near-NULL address 0x23c (or 0xc8) in Flash Player on Linux x64 — indicative of use-after-free or non-deterministic memory corruption triggered by a malicious SWF file ↗
→Monitor for SIGSEGV signals originating from Flash Player (plugin/standalone) process on Linux x64 with faulting address in low memory ranges (e.g. 0x23c, 0xc8) or anomalously high addresses (e.g. 0x400000001), which may indicate exploitation of this vulnerability via a crafted SWF ↗

·The crash address is non-deterministic across builds and runs — the same SWF may fault at 0x23c, 0xc8, or 0x400000001 depending on heap state, making signature-based detection on fault address alone unreliable ↗
·The PoC was demonstrated against Flash v17.0.0.188 on Linux x64; the CVE formally covers Flash before 18.0.0.232 (Windows/OS X) and before 11.2.202.508 (Linux), so behaviour may differ across platforms and versions ↗

CVSS provenance

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

osv10.0CRITICAL

vendor_redhat10.0CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.