CVE-2015-0359 Public exploit EPSS 92.1%

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows…

Summary

A double free vulnerability in Adobe Flash Player allows attackers to execute arbitrary code via unspecified vectors. It affects Windows, OS X, and Linux users running versions before the specified fixed releases.

Official description · CVE.org

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0346.

Breakdown

66.4 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseAI-written (claude-haiku-5-5)Medium confidence3 general detection rules
What they do
- Run code when a user opens a file or pageT1203 · Exploitation for Client ExecutionAI-written (claude-haiku-5-5)Medium confidence35 general detection rules

First seen exploited 7 months after disclosure. Public exploit code (Metasploit) was available 12 months before disclosure.

Public exploit codeMetasploit14 Apr 201412 mo before
Disclosed14 Apr 2015day 0
First seen exploitedVulnCheck KEV evidence9 Nov 2015+7 mo

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium

AI mapping from the description · how it is exploited

Unspecified vectors suggest drive-by or malicious content delivery

allows attackers to execute arbitrary code via unspecified vectors

From the official description (CVE.org) Original ↗

ExecutionTA0002

Exploitation for Client Execution T1203 Medium

AI mapping from the description · primary impact

Flash content triggers memory corruption and arbitrary code execution

Double free vulnerability in Adobe Flash Player before 13.0.0.281

From the official description (CVE.org) Original ↗

Detection

0 rules for this CVE · 38 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-0359 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Exploitation for Client ExecutionT120335 general rules

Antivirus - Exploitation Framework Signaturecriticalstable
Droppers Exploiting CVE-2017-11882criticalstable
Audit CVE Eventcriticaltest
CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
Exploit for CVE-2017-8759criticaltest
Antivirus - APT Malware Signaturecriticalexperimental
Antivirus - Remote Access Tools Signaturecriticalexperimental

All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportMicrosoft

Reports are matched by finding the exact id CVE-2015-0359 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

Addressed by Exploit kit(s) CVE-2015-0310 Adobe Flash Player APSB15-02 Angler (JS/Axpergle) CVE-2015-0311 Adobe Flash Player APSB15-03 Angler CVE-2015-0313 Adobe Flash Player APSB15-04 Angler CVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler CVE-2015-0359 Adobe Flash Player APSB15-06…

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 12 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

2015: Malware Analysis Report1 May 2026
TrojanDownloader:Win32/Tsunovest.A4 Mar 2025
Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows13 Jun 2024
Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'11 Jun 2024
Log4j12 Jan 2022
Ransomware: Night Sky12 Jan 2022
6 more on OTX

References

9 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2015-0372

Adobe Flash Player - domainMemory ByteArray Use-After-Free (Metasploit)EDB-36956 · remote · windows · 2015-05-08 · verified

, 30 Oct 2026

92.1%Top 0.18%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.82%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 4009 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9982 20.0/20

Threat reports1 report 3.9/10

Public exploit code1 Exploit-DB entry; 1 Metasploit module 5.0/5

Mentioned in OTX pulses12 pulses 2.5/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total66.4

Record

Published: 14 Apr 2015
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Microsoft Security

Also mentioned in 12 community threat pulses (AlienVault OTX)

References

vendor-advisory 6

vdb-entry 2

x_refsource_CONFIRM 1

How attackers get in

What they do

techniques