CVE-2015-5574

CVE-2015-5574 is a critical-severity vulnerability in Adobe Flash Player with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 46% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 46% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Adobe Flash Player
• Published: 2015-09-22
• Last modified: 2026-06-17

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.

Frequently asked questions

What is CVE-2015-5574?

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5581, CVE-2015-5584, and CVE-2015-6682.

How severe is CVE-2015-5574?

CVE-2015-5574 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2015-5574 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 46% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-5574?

CVE-2015-5574 primarily affects Adobe Flash Player. In total, 28 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-5574?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2015-5574 published?

CVE-2015-5574 was published on 2015-09-22 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html
• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html
• http://rhn.redhat.com/errata/RHSA-2015-1814.html
• http://www.securityfocus.com/bid/76795
• http://www.securitytracker.com/id/1033629
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04939841
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
• https://helpx.adobe.com/security/products/flash-player/apsb15-23.html
• https://security.gentoo.org/glsa/201509-07
• https://www.exploit-db.com/exploits/39652/

Affected products (28)

• cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:17.0.0.188:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:17.0.0.190:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:17.0.0.191:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:18.0.0.160:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:18.0.0.194:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:18.0.0.203:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:18.0.0.209:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:flash_player:18.0.0.232:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*

More vulnerabilities in Adobe Flash Player

• CVE-2015-8459 — Critical (CVSS 10.0): Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on…
• CVE-2015-8457 — Critical (CVSS 10.0): Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and…
• CVE-2015-8455 — Critical (CVSS 10.0): Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on…
• CVE-2015-8454 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and…
• CVE-2015-8452 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and…
• CVE-2015-8451 — Critical (CVSS 10.0): Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on…

All CVEs affecting Adobe Flash Player →