CVE-2015-5123

What Is Adobe Flash Player?

Adobe Flash Player was the ubiquitous cross-platform multimedia browser plugin, installed on over 90% of internet-connected computers at peak deployment. Flash's universal presence made every Flash vulnerability a potential attack vector against virtually any Windows, macOS, or Linux system with a browser. Adobe ended Flash Player support December 31, 2020.

Overview

CVE-2015-5123 is the third Flash zero-day exposed by the July 2015 Hacking Team breach — a use-after-free in the ActionScript 3 BitmapData class. It was discovered alongside CVE-2015-5122 (DisplayObject UAF) in Hacking Team's leaked exploit code and patched together in Adobe's APSB15-18 (July 14, 2015). The three Hacking Team Flash zero-days (CVE-2015-5119, CVE-2015-5122, CVE-2015-5123) collectively represented a simultaneous cache of Flash exploits that made July 2015 the worst month for Flash zero-days in the plugin's history.

Affected Versions

Technical Details

Root Cause: Use-After-Free in AS3 BitmapData

CVE-2015-5123 is a use-after-free (CWE-416) in Flash's BitmapData class — a core ActionScript 3 type representing a pixel array used for bitmap image manipulation, pixel blitting, and graphics operations. BitmapData objects hold references to pixel data buffers allocated in Flash's heap.

The UAF occurs through:

1. A BitmapData object is freed or garbage collected while a stale ActionScript reference remains
2. The freed memory is reallocated for an attacker-controlled object (via heap grooming with predictable AS3 allocations)
3. Operations on the stale BitmapData reference interact with the attacker-controlled allocation
4. This provides the attacker with type confusion — treating attacker-controlled data as a BitmapData object — enabling controlled heap read/write

Combined with a heap spray to place predictable data at known addresses, this class of UAF is highly reliable for achieving code execution in Flash's JIT-compiled ActionScript environment.

Three Zero-Days, One Breach

The Hacking Team breach simultaneously exposed three distinct Flash UAFs targeting three different AS3 classes:

Each targets a different Flash subsystem — binary data, display rendering, and pixel graphics respectively — demonstrating that Hacking Team's researchers had conducted deep, systematic analysis of Flash's memory management across multiple components.

Attack Characteristics

Discovery

Identified by security researchers analyzing the Hacking Team breach dump. Adobe patched CVE-2015-5123 alongside CVE-2015-5122 in APSB15-18 on July 14, 2015, six days after the first Hacking Team Flash patch (APSB15-16 for CVE-2015-5119).

Exploitation Context

• Depth of zero-day inventory: The existence of three simultaneous Flash zero-days in a single company's exploit toolkit was remarkable; it indicated that well-resourced offensive security teams were conducting systematic Flash vulnerability research across multiple internal subsystems
• Cascading exploitation windows: The sequential release of three patches over nine days meant that even organizations with excellent patch management were exposed to at least one Hacking Team Flash zero-day for the entire period; organizations patching APSB15-16 immediately still faced CVE-2015-5122 and CVE-2015-5123 for six more days
• Exploit kit arsenal expansion: Exploit kits added each Hacking Team zero-day to their arsenal; Angler in particular rapidly integrated all three CVEs, using whichever remained unpatched on the target system
• Flash EOL legacy: Flash is permanently end-of-life since December 2020; all known Flash vulnerabilities remain permanently unpatched
• CISA KEV (2022): Added April 2022

Remediation

1. Remove Flash Player — uninstall from all systems. Adobe's Flash uninstaller and Microsoft's KB4577586 (Windows Update) remove Flash from Windows. Flash is permanently end-of-life with no further security updates.

2. Migrate Flash-dependent applications — identify remaining Flash content (internal apps, kiosks, ICS HMIs) and migrate to HTML5 or another supported technology.

3. Network isolation — Flash-dependent systems that cannot be decommissioned should be isolated from internet access and untrusted networks.

4. Browser controls — all modern browsers have removed Flash support. IE11 with Flash (if still present) should be upgraded to Edge or Chrome.