{"id":"CVE-2015-0310","kind":"vulnerability","aliases":["CVE-2015-0310"],"related":[],"title":"Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before…","description":"Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.","summary":"Adobe Flash Player does not properly restrict discovery of memory addresses, which lets attackers bypass ASLR, a memory randomization defense. An attacker typically pairs this with another flaw to run code, and it is listed as actively exploited.","severity":"critical","cvss":10.0,"epss":0.15097,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"adobe flash player","fixed":["11.2.202.438"],"affected":"< 11.2.202.438","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["13.0.0.262"],"affected":"< 13.0.0.262","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["16.0.0.287"],"affected":">= 14.0, < 16.0.0.287","ecosystem":"vendor"},{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-flash-player","browsers","exploited","macos","other","windows"],"not_affected_if":["no-flash-installed"],"how_to_check":"Check whether Adobe Flash Player is installed on any machine, for example by looking for Flash Player plugin files in browser plugin directories or the installed program list.","fix":"Uninstall Adobe Flash Player and disconnect any system still using it, as Adobe Flash Player is end-of-life.","status":"open","published_at":"2015-01-23T21:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:13:03+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:13:03Z","model":"claude-haiku-5-5","output":{"fix":"Uninstall Adobe Flash Player and disconnect any system still using it, as Adobe Flash Player is end-of-life.\nunknown","reach":"internet","impact":"medium","summary":"Adobe Flash Player does not properly restrict discovery of memory addresses, which lets attackers bypass ASLR, a memory randomization defense. An attacker typically pairs this with another flaw to run code, and it is listed as actively exploited.","category":"other","who_cares":["adobe-flash-player","browsers","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker bypasses ASLR, aiding code execution when chained with another flaw.","analyst_note":"","how_to_check":"Check whether Adobe Flash Player is installed on any machine, for example by looking for Flash Player plugin files in browser plugin directories or the installed program list.\nunknown","needs_analyst":false,"not_affected_if":["no-flash-installed"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000473,"input_tokens":2848,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0310':21A,24A '-2015':20A,23A '11.2.202.438':104C '13.0.0.262':5A,88C '14':7A,90C '16':10A,93C '16.0.0.287':13A,96C '2015':144C 'activ':82B 'address':56B,114C 'adob':1A,38B,46B,84C 'adobe':25A,28A,31A,34A 'adobe-flash-play':37B 'allow':116C 'anoth':72B 'aslr':61B,121C 'attack':59B,67B,117C 'browser':41B 'bypass':60B,119C 'code':76B 'cve':19A,22A 'defens':65B 'discoveri':53B,111C 'exploit':42B,83B,138C 'flash':2A,26A,29A,32A,35A,39B,47B,85C 'flaw':73B 'impact':130C 'januari':143C 'let':58B 'linux':106C 'list':80B 'maco':43B 'mechan':123C 'memori':55B,63B,113C 'os':17A,100C 'pair':69B 'platform':133C 'player':3A,27A,30A,33A,36A,40B,48B,86C 'proper':51B,109C 'protect':122C 'random':64B 'restrict':52B,110C 'run':75B 'typic':68B 'unknown':135C 'unspecifi':129C 'vector':136C 'via':134C 'wild':141C 'window':15A,45B,98C,125C 'x':8A,11A,18A,91C,94C,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-01-23T21:59:00+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-0310","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-0310","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2015-0310","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0310","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-0310","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0310","severity":null,"published_at":"2015-01-23T21:59:00+00:00","modified_at":"2026-06-17T00:19:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}