CVE-2015-8644

HIGH

Adobe Flash Player <18.0.0.324-20.0.0.267 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-8644. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit describes a type confusion vulnerability in Adobe Flash's SimpleButton constructor, where an empty button object can be manipulated via SWF tag alteration to cause type confusion. The PoC requires manual hex editing of a SWF file to trigger the issue.

Description

Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Exploits (1)

exploitdb WRITEUP VERIFIED
by Google Security Research · textdosmultiple
https://www.exploit-db.com/exploits/39476

The exploit describes a type confusion vulnerability in Adobe Flash's SimpleButton constructor, where an empty button object can be manipulated via SWF tag alteration to cause type confusion. The PoC requires manual hex editing of a SWF file to trigger the issue.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Complex
Reliability
Theoretical
Target: Adobe Flash Player (versions affected by CVE-2015-8644)
No auth needed
Prerequisites: Hex editor · Flasm tool · Custom SWF file with SimpleButton code
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39476/
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2697.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/79704
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201601-03
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034544

Scores

CVSS v3 8.8
EPSS 0.2731
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (10)
adobe/air < 20.0.0.204
adobe/air_sdk < 20.0.0.204
adobe/air_sdk_\&_compiler < 20.0.0.204
adobe/flash_player 19.0.0.185
adobe/flash_player 19.0.0.207
adobe/flash_player 19.0.0.226
adobe/flash_player 19.0.0.245
adobe/flash_player 20.0.0.228
adobe/flash_player 20.0.0.235
adobe/flash_player < 18.0.0.268
Published Dec 28, 2015
Tracked Since Feb 18, 2026