{"id":"CVE-2015-0311","published":"2015-01-23T21:59:04Z","modified":"2026-06-17T00:19:58Z","title":"Adobe Flash Player Remote Code Execution Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":null,"description":{"text":"Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.","provenance":"source","from":"NVD"},"summary":{"text":"Adobe Flash Player contains an unspecified flaw in its handling of content, affecting versions through 13.0.0.262, the 14.x, 15.x and 16.x lines through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux. A remote attacker with no privileges and no required user interaction can execute arbitrary code by using unknown vectors, with the attack carried out over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:59Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.85589,"percentile":0.99723,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-04-13","dueDate":"2022-05-04","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-0311","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-01-20","exploitedFirstSeen":"2015-01-20","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-01-20"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0311","date":"2015-01-23"},{"url":"https://www.fireeye.com/blog/threat-research/2015/01/a_different_exploit.html","date":"2015-01-27"},{"url":"https://threatpost.com/cryptolocker-variant-coming-after-gamers/111611/","date":"2015-03-12"},{"url":"https://blog.talosintelligence.com/2015/04/threat-spotlight-teslacrypt-decrypt-it.html","date":"2015-04-27"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-13"},{"url":"https://www.gendigital.com/blog/insights/research/the-group-theory-inside-bedeps-dga","date":"2026-04-22"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://helpx.adobe.com/security/products/flash-player/apsa15-01.html","tags":["Vendor Advisory"]},{"url":"http://helpx.adobe.com/security/products/flash-player/apsb15-03.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/62432","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62543","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62650","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62660","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62740","tags":["Broken Link"]},{"url":"http://security.gentoo.org/glsa/glsa-201502-02.xml","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/72283","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1031597","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://technet.microsoft.com/library/security/2755801","tags":["Patch","Vendor Advisory"]},{"url":"http://helpx.adobe.com/security/products/flash-player/apsa15-01.html","tags":["Vendor Advisory"]},{"url":"http://helpx.adobe.com/security/products/flash-player/apsb15-03.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/62432","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62543","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62650","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62660","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/62740","tags":["Broken Link"]},{"url":"http://security.gentoo.org/glsa/glsa-201502-02.xml","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/72283","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1031597","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://technet.microsoft.com/library/security/2755801","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0311","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via unknown remote vectors, in-the-wild exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via unknown vectors","start":165,"end":234}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Flash content executes code on victim client","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":165,"end":214}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"(CVE-2013-2551), Adobe Flash Player (CVE-2015-0310, CVE-2015-0311, and","start":99150,"end":99220},{"quote":"Adobe Flash Player (CVE-2015-8651 and CVE-2015-0311), Java (CVE-2013-","start":100025,"end":100094},{"quote":"62\r\nCVE-2012-0507, 57\r\nCVE-2012-1723, 56, 57, 58, 59\r\nCVE-2012-1889, 64\r\nCVE-2013-0074, 56\r\nCVE-2013-0422, 57, 59\r\nCVE-2013-1493, 56\r\nCVE-2013-2423, 56\r\nCVE-2013-2460, 56\r\nCVE-2013-2551, 56\r\nCVE-2013-3896, 56\r\nCVE-2014-1761, 62\r\nCVE-2014-6332, 61\r\nCVE-2015-0072, 64\r\nCVE-2015-0310, 56\r\nCVE-2015-0311,","start":261330,"end":261630}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"Player (CVE-2014-8439, CVE-2015-0311, and CVE-2015-0313,","start":79994,"end":80050},{"quote":"CVE-2015-0311 Adobe Flash Player APSB15-03 Angler","start":81716,"end":81765},{"quote":"CVE-2014-8439, CVE-2015-0311, CVE-2015-0313, and CVE-2015-0359;","start":93043,"end":93106},{"quote":"CVE-2015-0311","start":94105,"end":94118},{"quote":"47, 48, 49\r\nCVE-2012-1889, 54\r\nCVE-2013-0074, 46\r\nCVE-2013-0422, 47, 49\r\nCVE-2013-2460, 46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331, 54\r\nCVE-2014-0322, 54\r\nCVE-2014-0497, 53\r\nCVE-2014-0515, 53\r\nCVE-2014-6332, 43, 44, 50\r\nCVE-2014-8439, 46, 53\r\nCVE-2015-0097, 57\r\nCVE-2015-0310, 47\r\nCVE-2015-0311, 46, 47,","start":238137,"end":238438}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-0324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-0324","exploited":true,"exploitedSince":"2022-04-13","provenance":"source"},"exploits":[{"id":36360,"url":"https://www.exploit-db.com/exploits/36360","title":"Adobe Flash Player - ByteArray UncompressViaZlibVariant Use-After-Free (Metasploit)","type":"remote","platform":"windows","date":"2015-03-12","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-03-12"},"metasploit":[{"name":"Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free","module":"exploit/multi/browser/adobe_flash_uncompress_zlib_uaf","type":"exploit","disclosureDate":"2014-04-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb"}],"first":{"date":"2014-04-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1189","T1203"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2014-04-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-03-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb","provenance":"source"},{"date":"2015-01-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-01-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0311","provenance":"source"},{"date":"2022-04-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-0324","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2637},"priority":{"score":85.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4300 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}