VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 11:31 UTC

CVE-2015-3043

Read full description

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.5/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.8: +1.17
Fresh EPSS: 73.86%: +0.37

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 5 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

ZDNET

Press · 21 Feb 2018, 08:00 · North Korean Reaper APT uses zero-day vulnerabilities to spy on governments - ZDNET

WIRED

Press · 11 Jan 2017, 08:00 · Exposed: how one of Russia's most sophisticated hacking groups operates - WIRED

Malwarebytes

Press · 28 Jun 2015, 07:00 · Recent Flash Player 0-day Exploit Goes Mainstream - Malwarebytes

Google Cloud

Press · 18 Apr 2015, 07:00 · Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack - Google Cloud

SecurityWeek

Press · 18 Apr 2015, 07:00 · Russian Hackers Used Two Zero-Days in Recent Targeted Attack: FireEye - SecurityWeek

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #37536 2015-07-08

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.8; EPSS 73.9%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, no prior privileges, user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:39.719437+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

14 Apr 2015, 22:00

First press mention

18 Apr 2015, 07:00

Latest press mention

21 Feb 2018, 08:00

Added to the CISA KEV catalog

03 Mar 2022, 00:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

1 repositories