{"id":"CVE-2015-3113","published":"2015-06-23T21:59:01Z","modified":"2026-06-17T00:25:19Z","title":"Adobe Flash Player Heap-Based Buffer Overflow Vulnerability","vendor":"Adobe","product":"Flash Player","tier":"core","eol":null,"description":{"text":"Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.","provenance":"source","from":"NVD"},"summary":{"text":"A heap-based buffer overflow in Adobe Flash Player affects versions before 13.0.0.296, 14.x through 18.x before 18.0.0.194 on Windows and OS X, and versions before 11.2.202.468 on Linux. An attacker who can get a victim to a location serving malicious content can execute arbitrary code, with no authentication, configuration, or additional user interaction required beyond the victim reaching that content.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:26Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99812,"percentile":0.99958,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-04-13","dueDate":"2022-05-04","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-3113","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-06-23","exploitedFirstSeen":"2015-06-23","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-06-23"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3113","date":"2015-06-23"},{"url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html","date":"2015-06-23"},{"url":"https://securelist.com/it-threat-evolution-q2-2015/71610/","date":"2015-07-30"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-13"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=144050155601375&w=2","tags":["Mailing List"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1184.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75371","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032696","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235036","tags":["Issue Tracking"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=935701","tags":["Issue Tracking"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467","tags":["Broken Link"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-14.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201507-13","tags":["Third Party Advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3113.html","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=144050155601375&w=2","tags":["Mailing List"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1184.html","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75371","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032696","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235036","tags":["Issue Tracking"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=935701","tags":["Issue Tracking"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467","tags":["Broken Link"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-14.html","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201507-13","tags":["Third Party Advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3113.html","tags":["Third Party Advisory"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3113","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion.","confidence":"high"},{"id":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["discovery","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion.","confidence":"high"},{"id":"T1622","name":"Debugger Evasion","tactics":["discovery","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion.","confidence":"high"}],"reports":[{"id":"SRC-cfb0a8d133b743d61cee","title":"BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/","date":"2021-02-09","mentions":[{"quote":"UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload","start":23100,"end":23173}]},{"id":"SRC-bc9af9dd604bcbbd89cd","title":"RECON MTL 2017 evolution of pirpi","publisher":"recon.cx","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf","date":null,"mentions":[{"quote":"• (CVE-2015-3113)","start":554,"end":571},{"quote":"for hash 4d3874480110ba537b3839cb8b416b50 and EXEProxy)\r\n• Palo Alto Networks:\r\n• https://researchcenter.paloaltonetworks.com/2015/07/apt -group-ups-targets-us-government-with-hacking-team-\r\nflash-exploit/\r\n• https://researchcenter.paloaltonetworks.com/2015/07/ups -observations-on-cve-2015-3113-prior-zero-days-and-","start":7896,"end":8212}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"APSB15-05 Nuclear (JS/Neclu); Angler\r\nCVE-2015-0359 Adobe Flash Player APSB15-06 Angler\r\nCVE-2015-3090 Adobe Flash Player APSB15-09 Angler\r\nCVE-2015-3104 Adobe Flash Player APSB15-11 Angler\r\nCVE-2015-3105 Adobe Flash Player APSB15-11 Magnitude (HTML/Pangimop)\r\nCVE-2015-3113 Adobe Flash Player APSB15-14","start":81851,"end":82154},{"quote":"47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47, 53\r\nCVE-2015-1641, 16, 57\r\nCVE-2015-1701, 14, 18, 19, 57\r\nCVE-2015-1769, 57\r\nCVE-2015-1770, 57\r\nCVE-2015-2360, 57\r\nCVE-2015-2424, 16, 17\r\nCVE-2015-3043, 17, 18, 57\r\nCVE-2015-3090, 47\r\nCVE-2015-3104, 47\r\nCVE-2015-3105, 47\r\nCVE-2015-3113,","start":238435,"end":238748}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-3194","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3194","exploited":true,"exploitedSince":"2022-04-13","provenance":"source"},"exploits":[{"id":37536,"url":"https://www.exploit-db.com/exploits/37536","title":"Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)","type":"remote","platform":"multiple","date":"2015-07-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-07-08"},"metasploit":[{"name":"Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow","module":"exploit/multi/browser/adobe_flash_nellymoser_bof","type":"exploit","disclosureDate":"2015-06-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb"}],"first":{"date":"2015-06-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1071.001"],"provenance":"source"},{"stage":"secondary","techniques":["T1497","T1622"],"provenance":"source"},{"stage":"related","techniques":["T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-06-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3113","provenance":"source"},{"date":"2015-06-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-07-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb","provenance":"source"},{"date":"2015-06-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2021-02-09","kind":"report","label":"Named in unit42.paloaltonetworks.com: BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/","provenance":"machine"},{"date":"2022-04-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3194","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":2486},"priority":{"score":77.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4146 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-adobe-flash-player-cwe-787"}}