CVE-2015-0336

EXPLOITED

Adobe Flash Player NetConnection Type Confusion

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2015-0336 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Metasploit, Natalie Silvanovich, Unknown, juan vazquez, including a Metasploit module exploits/multi/browser/adobe_flash_net_connection_confusion.

AI-analyzed exploit summary This Metasploit module exploits a type confusion vulnerability in Adobe Flash Player's NetConnection class (CVE-2015-0336) to achieve remote code execution. It uses a crafted SWF file and PowerShell payload to exploit vulnerable Flash versions (16.0.0.305 and earlier) on Windows 7 with Internet Explorer.

Description

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/36962

This Metasploit module exploits a type confusion vulnerability in Adobe Flash Player's NetConnection class (CVE-2015-0336) to achieve remote code execution. It uses a crafted SWF file and PowerShell payload to exploit vulnerable Flash versions (16.0.0.305 and earlier) on Windows 7 with Internet Explorer.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player <= 16.0.0.305
No auth needed
Prerequisites: Vulnerable Flash Player version · Target using Internet Explorer on Windows 7 · Memory layout conducive to exploitation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by Natalie Silvanovich, Unknown, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_net_connection_confusion.rb

This Metasploit module exploits a type confusion vulnerability in Adobe Flash Player's NetConnection class (CVE-2015-0336) to achieve remote code execution. It leverages memory corruption to overwrite objects and execute arbitrary payloads on vulnerable systems.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Adobe Flash Player (versions up to 16.0.0.305 on Windows, 11.2.202.442 on Linux)
No auth needed
Prerequisites: Vulnerable Adobe Flash Player version · Browser with Flash support · Target system matching exploit constraints (Windows 7/8.1 or Linux)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201503-09
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/36962/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/73084
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0697.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031922

Scores

EPSS 0.8194
EPSS Percentile 99.6%

Details

VulnCheck KEV 2015-06-05
Status published
Products (16)
adobe/flash_player 14.0.0.125
adobe/flash_player 14.0.0.145
adobe/flash_player 14.0.0.176
adobe/flash_player 14.0.0.179
adobe/flash_player 15.0.0.152
adobe/flash_player 15.0.0.167
adobe/flash_player 15.0.0.189
adobe/flash_player 15.0.0.223
adobe/flash_player 15.0.0.239
adobe/flash_player 15.0.0.246
... and 6 more
Published Mar 13, 2015
Tracked Since Feb 18, 2026