CVE-2015-3104 EPSS 5.7%

Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X…

Official description · CVE.org

Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.

Breakdown

57.5 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 1
Tactics: 0/15

First seen exploited 50 days after disclosure.

Disclosed10 Jun 2015day 0
First seen exploitedVulnCheck KEV evidence30 Jul 2015+50 days

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Named in 1 threat report

1 reportMicrosoft

Reports are matched by finding the exact id CVE-2015-3104 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

Adobe Flash Player APSB15-03 Angler CVE-2015-0313 Adobe Flash Player APSB15-04 Angler CVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler CVE-2015-0359 Adobe Flash Player APSB15-06 Angler CVE-2015-3090 Adobe Flash Player APSB15-09 Angler CVE-2015-3104 Adobe Flash Player APSB15-11…

2 passages name itOriginal (opens in a new tab) ↗

References

8 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2015-3185

No public exploit code found.

, 30 Oct 2026

5.7%Top 7%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 93%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 4111 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9305 18.6/20

Threat reports1 report 3.9/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total57.5

Record

Published: 10 Jun 2015
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

What security researchers reported

Microsoft Security

References

x_refsource_CONFIRM 1

vdb-entry 2

vendor-advisory 5

techniques