CVE-2015-5562: Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18

Q: How do I fix CVE-2015-5562?

flash player: upgrade to newer than 18.0.0.209; air: upgrade to newer than 18.0.0.180; air sdk: upgrade to newer than 18.0.0.180. Exact commands for each OS are on this page.

Q: Is CVE-2015-5562 being exploited?

CVE-2015-5562 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2015-5562 affect?

CVE-2015-5562 affects flash player, air, air sdk. Severity is high (CVSS 10.0). Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary cod

Q: How urgent is CVE-2015-5562?

Priority 70/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

This week

HIGH 10.0WATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2015-5562 is a high-severity flaw (CVSS 10.0) affecting flash player, air, air sdk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5555, and CVE-2015-5558.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (High)
EPSS exploit chance	44.4% (top 1%)
CISA exploited list	No
Published	2015-08-14
Last modified	2026-06-17

Publisher (CNA): Adobe Systems Incorporated · Vendor: adobe

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2015-08-14 01:59 UTCPublished CVE record published
2026-06-17 00:29 UTCUpdated Record last modified

adobe flash player UPGRADE

Affected: <= 18.0.0.209 · <= 11.2.202.491

Fixed in: newer than 18.0.0.209

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy flash-player || rpm -q flash-player || flash-player --version

2. UPGRADE to newer than 18.0.0.209 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade flash-player

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade flash-player

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe air UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air || rpm -q air || air --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe air sdk UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air-sdk || rpm -q air-sdk || air-sdk --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air-sdk

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air-sdk

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

adobe air sdk \& compiler UPGRADE

Affected: <= 18.0.0.180

Fixed in: newer than 18.0.0.180

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy air-sdk--compiler || rpm -q air-sdk--compiler || air-sdk--compiler --version

2. UPGRADE to newer than 18.0.0.180 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade air-sdk--compiler

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade air-sdk--compiler

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · rust-tokio · FIXED · 1.54.1-1.fc46 · FEDORA-2026-e7fd815169 · source

sudo dnf upgrade --advisory=FEDORA-2026-e7fd815169

Fedora ELN · libopenraw · FIXED · 0.3.7-2.eln159 · FEDORA-2026-3fa115dd38 · source

sudo dnf upgrade --advisory=FEDORA-2026-3fa115dd38

RHEL 5 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.508-1.el5

sudo dnf upgrade --advisory=RHSA-2015:1603 rpm -q flash-plugin

RHEL 6 Supplementary · flash-plugin · FIXED · flash-plugin-11.2.202.508-1.el6_7

sudo dnf upgrade --advisory=RHSA-2015:1603 rpm -q flash-plugin

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
Write-up: h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
Exploit-DB: Adobe Flash - Shared Object Type Confusion

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2015-5562?

flash player: upgrade to newer than 18.0.0.209; air: upgrade to newer than 18.0.0.180; air sdk: upgrade to newer than 18.0.0.180. Exact commands for each OS are on this page.

Is CVE-2015-5562 being exploited?

CVE-2015-5562 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2015-5562 affect?

CVE-2015-5562 affects flash player, air, air sdk. Severity is high (CVSS 10.0). Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary cod

How urgent is CVE-2015-5562?

Priority 70/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

Software pages

Windows vulnerabilities · Adobe Flash vulnerabilities

Related CVEs

CVE-2018-15982 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Adobe Flash Player Use-After-Free Vulnerability
CVE-2016-1019 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Adobe Flash Player Arbitrary Code Execution Vulnerability
CVE-2016-4117 CRITICAL 9.8 EXPLOITED UPGRADE MITIGATE Adobe Flash Player Arbitrary Code Execution Vulnerability
CVE-2011-0627 HIGH 8.8 UPGRADE Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Andro
CVE-2020-9746 HIGH 7.0 UPGRADE UPGRADE Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vu

References

← Back to latest CVEs