CVE-2015-8446

CVE-2015-8446 is a heap-based buffer overflow vulnerability in Adobe Flash Player, AIR, AIR SDK, and AIR SDK & Compiler across Windows, OS X, and Linux platforms. This flaw allows attackers to execute arbitrary code by crafting malicious MP3 files with specially designed COMM tags that mishandle memory allocation. With a CVSS score of 9.3, this vulnerability is critical, requiring no authentication and having high impact on confidentiality, integrity, and availability, though it requires medium attack complexity. While not listed in CISA's KEV catalog, it has garnered significant community discussion and media coverage, including reports of it being exploited in the wild by ransomware like TeslaCrypt. Despite this, no public exploit code is readily available on platforms like Metasploit or ExploitDB.