CVE-2015-8439

CRITICAL 9.3CVE-2015-8439 · Published 10/12/2015 · updated 17/06/2026

In short

CVE-2015-8439 is a CRITICAL (CVSS 9.3) vulnerability affecting air (adobe), air sdk (adobe), air sdk & compiler (adobe).
Chance of exploitation in the next 30 days (EPSS): 6.6%, higher than 93.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
air adobe	`≤ 19.0.0.241`	No fix yet
air sdk adobe	`≤ 19.0.0.241`	No fix yet
air sdk & compiler adobe	`≤ 19.0.0.241`	No fix yet
flash player adobe	`= 19.0.0.185= 19.0.0.207= 19.0.0.226= 19.0.0.245≤ 11.2.202.548≤ 18.0.0.261`	No fix yet

Description

The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code by leveraging an unspecified "type confusion" during a getRemote call, a different vulnerability than CVE-2015-8456.

References

More vulnerabilities in air

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free