Loading vulnerability…
CVE-2015-5119 is a use-after-free vulnerability in the ActionScript 3 implementation of the ByteArray class in Adobe Flash Player. A crafted Flash object can trigger memory corruption by overriding a valueOf function during ByteArray handling, causing the application to access freed memory. The flaw affects Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X, and 11.x through 11.2.202.468 on Linux. Successful exploitation can result in arbitrary code execution in the security context of the user running Flash Player, and it was exploited in the wild in 2015 following public release of exploit material.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module: 'adobe_flash_hacking_team_uaf.rb', which exploits a use-after-free vulnerability (CVE-2015-5119) in Adobe Flash Player's ByteArray handling. The exploit targets vulnerable versions of Flash Player on Windows and Linux platforms, specifically on Windows 7/8.1 (32-bit) and Linux Mint (32-bit) with Internet Explorer or Firefox browsers. The module sets up a browser exploit server that serves a malicious HTML page and SWF file to the victim. When a user visits the attacker's page, the SWF triggers the vulnerability, allowing the attacker to execute arbitrary code (Metasploit payloads) on the victim's machine. The exploit is weaponized, supporting customizable payloads, and is part of the Metasploit framework. The only external endpoint referenced is the official Macromedia Flash Player ActiveX control CAB file, used in the HTML template. The repository is structured as a single Ruby file implementing the exploit logic, leveraging Metasploit's BrowserExploitServer mixin to deliver the attack.
This repository contains a proof-of-concept (POC) exploit for CVE-2015-5119, a critical vulnerability in Adobe Flash Player. The repository consists of four ActionScript (.as) files and a README. The main file, '0_poc.as', demonstrates the core exploit technique: it manipulates a ByteArray object and uses a custom valueOf method on an object to trigger a memory corruption condition. The other ActionScript files ('1_simplebyte.as', '2_simpleobject.as', '3_object_withvalueOf.as') provide simplified or incremental examples of ByteArray and object manipulation, likely to illustrate the steps leading up to the full exploit. There are no hardcoded network endpoints or file paths; the exploit is designed to be run in a Flash environment, typically within a browser. The code serves as a POC for researchers or analysts studying the vulnerability, rather than a weaponized exploit.
This repository contains a full exploit for CVE-2015-5119, a critical use-after-free vulnerability in Adobe Flash Player. The exploit is implemented in ActionScript 3 and is designed to be compiled into a malicious SWF file (CVE-2015-5119.swf), which is then loaded via an HTML page (bin/index.html) using JavaScript (swfobject.js). The exploit leverages heap spraying and memory corruption techniques to achieve arbitrary code execution. The code is modular, with separate classes for memory manipulation (ExploitByteArray, ExploitVector), ELF/PE parsing (Elf.as, PE.as, PE64.as), and the main exploit logic (Exploit.as, MyClass.as, Exploiter.as, Exploiter64.as). The exploit is capable of targeting both Windows and Linux platforms, depending on the payload and platform parameters. The payload is provided as a base64-encoded string, decoded at runtime, and executed as shellcode. The repository is operational and provides a working exploit chain, but the payload must be supplied by the attacker. No hardcoded C2 or network endpoints are present; exploitation is achieved via browser delivery of the SWF file.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day remote code execution vulnerability in Adobe Flash Player disclosed via the HackingTeam leak and significant because exploit code was exposed publicly before Adobe issued a patch.
A vulnerability heavily used by named threat actors (details not specified in content).
A vulnerability frequently used by named threat actors, likely for remote code execution.
An Adobe Flash zero-day exploit included in the leaked HackingTeam toolset.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.