CVE-2015-8410 is a critical use-after-free vulnerability in Adobe Flash Player, affecting versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228, and 11.2.202.554 on Linux, as well as Adobe AIR and its SDKs. This flaw allows attackers to execute arbitrary code on affected Windows, OS X, and Linux systems. The vulnerability carries a maximum CVSS score of 10.0, indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Its high EPSS and FAUCET Risk Scores highlight the significant likelihood and impact of exploitation. While not listed on CISA's KEV catalog, an exploit for this vulnerability (EDB-39040) is available on ExploitDB, demonstrating its exploitability. The vulnerability has garnered community discussion and media coverage, including an article from BleepingComputer, underscoring its historical relevance and the importance of patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 18.0.0.261CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
19.0.0.185CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.185:*:*:*:*:*:*:* | ||
19.0.0.207CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.207:*:*:*:*:*:*:* | ||
19.0.0.226CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.226:*:*:*:*:*:*:* | ||
19.0.0.245CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.245:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.