Technical intelligence and weaponization dossier for CVE-2015-0311. Documented exploitation across 1 active malware families totaling 9 analyzed telemetry samples.
| Vulnerability ID | CVE-2015-0311 |
|---|---|
| Common Name / Bulletin | Adobe Flash Player ByteArray Uncompress Use-After-Free (Angler EK) (APSB15-03) |
| CWE Classification | CWE-416: Use After Free in ActionScript ByteArray |
| Affected Software & Versions | Adobe Flash Player 16.0.0.287 and earlier |
| Technical Root Cause | Use-after-free in ActionScript ByteArray uncompress method inside Flash, weaponized by Angler Exploit Kit and TeslaCrypt ransomware. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| teslacrypt | Ransomware | 9 | TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encryptin... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2015-0311 in enterprise networks:
Web gateway detection of SWF payloads invoking ByteArray.uncompress() concurrently with memory re-allocation routines.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →