CVE-2015-5119

CWE-416

Critical

103.8

RPS

Description

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

Source: NVD

CVSS: 9.8; Critical · v3.1
EPSS: 99.32%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Mar 2022
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-416
Published: 8 Jul 2015; Last modified 21 Apr 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2015-5119

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2015-5119

Description

Signals

Get this score from the API