CVE-2015-3113

Adobe Flash Player's unpatched heap-based buffer overflow allowed remote attackers to execute code, proving that end-of-life software remains a perpetual security liability.

Adobe Flash Player reached end-of-life in December 2020 without further security updates, leaving all installed instances perpetually vulnerable to unpatched exploits. This failure demonstrates that maintaining legacy software without patches creates a continuous exposure to remote code execution, which compliance officers must address by ensuring no unpatched EOL products remain in scope.

Shame score — Adobe failed to patch a known critical vulnerability in a product that was already end-of-life, showing a complete lack of security stewardship for legacy systems.