CVE-2015-5123

Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, and the product's end-of-life status left it perpetually unpatched.

Adobe Flash Player contained a use-after-free vulnerability in its BitmapData class that enabled remote code execution. Because Flash reached end-of-life in December 2020, no patches were issued, leaving any remaining installations perpetually vulnerable to unpatched exploits. DIB organizations must ensure Flash is completely removed from all systems to avoid exposure to actively exploited vulnerabilities.

Shame score — The product was end-of-life with no patches, leaving known critical vulnerabilities unpatched and perpetually exploitable.