CVE-2015-7645

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11...

7.8 HighIn KEVPublic exploitFix available

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

65.3%Down 16.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

Record: CVE-2015-7645
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List 7.8

Record: CVE-2015-7645
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2015-7548 7.8

Record: EUVD-2015-7548
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-67j3-p5pq-jgr7 7.8

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11...

Record: GHSA-67j3-p5pq-jgr7
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CISA KEV No score

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.

Record: CVE-2015-7645
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-7645 7.8

Record: UBUNTU-CVE-2015-7645
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2015-0404 No score

Updated flash-player-plugin package fix security vulnerabilities

Adobe Flash Player 11.2.202.540 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.

This update resolves type confusion vulnerabilities that could lead to code execution (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648).

An exploit for CVE-2015-7645 is being used in the wild.

Record: MGASA-2015-0404
Updated: 2026-11-02

OSVSUSE-SU-2015:1770-1 No score

Security update for flash-player

flash-player was updated to fix one security issue.

This security issue was fixed:

CVE-2015-7645: Critical vulnerability affecting 11.2.202.535 used in Pawn Storm (APSA15-05) (bsc#950474).

Record: SUSE-SU-2015:1770-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1771-1 No score

Security update for flash-player

flash-player was updated to fix one security issue.

This security issue was fixed:

CVE-2015-7645: Critical vulnerability affecting 11.2.202.535 used in Pawn Storm (APSA15-05) (bsc#950474).

Record: SUSE-SU-2015:1771-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:5 From an advisory covering 3 CVEs	before 11.2.202.540-1.mga5.nonfree	11.2.202.540-1.mga5.nonfree
`flash-plugin` Red Hat:rhel_extras:6 From an advisory covering 3 CVEs	before 0:11.2.202.540-1.el6_7	0:11.2.202.540-1.el6_7
`flash-plugin` Red Hat:rhel_extras:5::client From an advisory covering 41 CVEs	before 0:11.2.202.548-1.el5	0:11.2.202.548-1.el5
`flash-plugin` Red Hat:rhel_extras:5::server From an advisory covering 41 CVEs	before 0:11.2.202.548-1.el5	0:11.2.202.548-1.el5
`flash-player` SUSE:Linux Enterprise Desktop 12	before 11.2.202.540-108.1	11.2.202.540-108.1
`flash-player` SUSE:Linux Enterprise Workstation Extension 12	before 11.2.202.540-108.1	11.2.202.540-108.1
`flash-player` SUSE:Linux Enterprise Desktop 11 SP3	before 11.2.202.540-0.23.1	11.2.202.540-0.23.1
`flash-player` SUSE:Linux Enterprise Desktop 11 SP4	before 11.2.202.540-0.23.1	11.2.202.540-0.23.1
`flashplugin-nonfree` Ubuntu:14.04:LTS	before 11.2.202.535ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 28 moreShow less 11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.1	11.2.202.535ubuntu0.14.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Adobe Flash - 'IExternalizable.writeExternal' Type Confusion	2015-10-19

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7645 is a high vulnerability (CVSS 7.8) in Adobe Flash Player, published October 15, 2015. CISA lists it as known to be exploited, since March 3, 2022. EUVD reports exploitation since March 3, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 65.3%, the 99th percentile. Fixed in flash-player 11.2.202.540-108.1.

References

Show 152 moreShow less