CVE-2015-3105

EXPLOITED RANSOMWARE

Adobe Flash Player Drawing Fill Shader Memory Corruption

Title source: metasploit

Exploitation Summary

CVE-2015-3105 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. EIP tracks 2 public exploits from researchers including Metasploit, Chris Evans, Unknown, juan vazquez, including a Metasploit module exploits/multi/browser/adobe_flash_shader_drawing_fill.

AI-analyzed exploit summary This Metasploit module exploits a memory corruption vulnerability in Adobe Flash Player (CVE-2015-3105) by applying a Shader as a drawing fill. It delivers a malicious SWF file via a browser exploit server, targeting specific versions of Flash on Windows and Linux.

Description

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotemultiple

https://www.exploit-db.com/exploits/37448

View Code ZIP pw:eip

This Metasploit module exploits a memory corruption vulnerability in Adobe Flash Player (CVE-2015-3105) by applying a Shader as a drawing fill. It delivers a malicious SWF file via a browser exploit server, targeting specific versions of Flash on Windows and Linux.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Adobe Flash Player <= 17.0.0.188 (Windows), <= 11.2.202.460 (Linux)

No auth needed

Prerequisites: Victim must visit a malicious webpage hosting the exploit · Target must have vulnerable Flash Player version installed

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC GREAT

by Chris Evans, Unknown, juan vazquez · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb

View Code ZIP pw:eip

This Metasploit module exploits a memory corruption vulnerability in Adobe Flash Player (CVE-2015-3105) by applying a Shader as a drawing fill, leading to remote code execution. It delivers a malicious SWF file via an HTML template to trigger the vulnerability.