---
id: "CVE-2015-0310"
kind: "vulnerability"
aliases: ["CVE-2015-0310"]
title: "Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before\u2026"
severity: "critical"
cvss: 10.0
epss: 0.15097
exploited: true
status: "open"
category: "other"
products: [{"name": "adobe flash player", "fixed": ["11.2.202.438"], "affected": "< 11.2.202.438", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["13.0.0.262"], "affected": "< 13.0.0.262", "ecosystem": "vendor"}, {"name": "adobe flash player", "fixed": ["16.0.0.287"], "affected": ">= 14.0, < 16.0.0.287", "ecosystem": "vendor"}, {"name": "Adobe Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-flash-player", "browsers", "exploited", "macos", "other", "windows"]
not_affected_if: ["no-flash-installed"]
published_at: "2015-01-23T21:59:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-0310", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-0310", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0310", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before…

Adobe Flash Player does not properly restrict discovery of memory addresses, which lets attackers bypass ASLR, a memory randomization defense. An attacker typically pairs this with another flaw to run code, and it is listed as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:adobe flash player affected < 11.2.202.438 fixed 11.2.202.438
- vendor:adobe flash player affected < 13.0.0.262 fixed 13.0.0.262
- vendor:adobe flash player affected >= 14.0, < 16.0.0.287 fixed 16.0.0.287
- vendor:Adobe Flash Player affected ? fixed ?

## How to check

Check whether Adobe Flash Player is installed on any machine, for example by looking for Flash Player plugin files in browser plugin directories or the installed program list.

## Fix

Uninstall Adobe Flash Player and disconnect any system still using it, as Adobe Flash Player is end-of-life.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-0310
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-0310
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-0310

## From the sources

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_