CVE-2015-5546: Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18

Q: How do I fix CVE-2015-5546?

air: upgrade to newer than 18.0.0.180; air sdk: upgrade to newer than 18.0.0.180; air sdk \& compiler: upgrade to newer than 18.0.0.180. Exact commands for each OS are on this page.

Q: Is CVE-2015-5546 being exploited?

CVE-2015-5546 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2015-5546 affect?

CVE-2015-5546 affects air, air sdk, air sdk \& compiler. Severity is high (CVSS 10.0). Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary cod

Q: How urgent is CVE-2015-5546?

Priority 70/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

This week

HIGH 10.0WATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2015-5546 is a high-severity flaw (CVSS 10.0) affecting air, air sdk, air sdk \& compiler. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (High)
EPSS exploit chance	38.2% (top 1%)
CISA exploited list	No
Weakness	CWE-119
Published	2015-08-14
Last modified	2026-06-17

Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2015-08-14 01:59 UTCPublished CVE record published
2026-06-17 00:29 UTCUpdated Record last modified

adobe air UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air || rpm -q air || air --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe air sdk UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air-sdk || rpm -q air-sdk || air-sdk --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air-sdk

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air-sdk

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe air sdk \& compiler UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air-sdk--compiler || rpm -q air-sdk--compiler || air-sdk--compiler --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air-sdk--compiler

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air-sdk--compiler

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe flash player UPGRADE

Affected: <= 18.0.0.209 · <= 11.2.202.491

Fixed in: newer than 18.0.0.209

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy flash-player || rpm -q flash-player || flash-player --version

2. UPGRADE to newer than 18.0.0.209 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade flash-player

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade flash-player

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · rust-tokio · FIXED · 1.54.1-1.fc46 · FEDORA-2026-e7fd815169 · source

sudo dnf upgrade --advisory=FEDORA-2026-e7fd815169

Fedora ELN · libopenraw · FIXED · 0.3.7-2.eln159 · FEDORA-2026-3fa115dd38 · source

sudo dnf upgrade --advisory=FEDORA-2026-3fa115dd38

RHEL 5 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.508-1.el5

sudo dnf upgrade --advisory=RHSA-2015:1603 rpm -q flash-plugin

RHEL 6 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.508-1.el6_7

sudo dnf upgrade --advisory=RHSA-2015:1603 rpm -q flash-plugin

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
Exploit-DB: Adobe Flash (Linux x64) - Bad Dereference at 0x23c

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2015-5546?

air: upgrade to newer than 18.0.0.180; air sdk: upgrade to newer than 18.0.0.180; air sdk \& compiler: upgrade to newer than 18.0.0.180. Exact commands for each OS are on this page.

Is CVE-2015-5546 being exploited?

CVE-2015-5546 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2015-5546 affect?

CVE-2015-5546 affects air, air sdk, air sdk \& compiler. Severity is high (CVSS 10.0). Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary cod

How urgent is CVE-2015-5546?

Priority 70/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

CVE-2016-1010 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Adobe Flash Player and AIR Integer Overflow Vulnerability
CVE-2016-1005 HIGH 8.8 UPGRADE UPGRADE Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11
CVE-2016-1002 HIGH 8.8 UPGRADE UPGRADE Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11
CVE-2016-1001 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on
CVE-2016-1000 HIGH 8.8 UPGRADE UPGRADE Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 o

References

← Back to latest CVEs