CVE-2015-5119

Adobe Flash Player's use-after-free vulnerability allowed remote code execution, and the product's end-of-life status meant it remained perpetually unpatched and exploitable.

Adobe Flash Player contained a use-after-free vulnerability in its ActionScript 3 ByteArray class that enabled remote code execution. Because Flash reached end-of-life in December 2020 without further patches, any remaining installations remained perpetually vulnerable to unpatched exploits, representing a severe compliance and security liability for organizations still supporting legacy systems.

Shame score — The product was discontinued and unpatched for years, leaving known vulnerabilities unaddressed and perpetually exploitable, which is a severe negligence failure.