{"id":"CVE-2018-4878","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-4878","generatedAt":"2026-10-29T01:51:51.137Z","title":"Adobe Flash Player Use-After-Free Vulnerability","description":"A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.","published":"2018-02-06T21:29:00.000Z","lastModified":"2026-06-17T01:59:12.000Z","status":"Analyzed","sourceIdentifier":"psirt@adobe.com","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-416"],"affected":["adobe/flash player","redhat/enterprise linux desktop","redhat/enterprise linux server","redhat/enterprise linux workstation"],"epss":{"score":0.9028,"percentile":0.99796,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","notes":"The impacted product is end-of-life and should be disconnected if still in use.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-4878"},"exploits":{"count":3,"verified":false,"firstPublished":"2016-02-13","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44412,"kind":"exploit","title":"Adobe Flash < 28.0.0.161 - Use-After-Free","url":"https://www.exploit-db.com/exploits/44412","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/44412.py","file":"exploits/multiple/remote/44412.py","published":"2018-04-06","added":"2018-04-06","updated":"2018-05-03","author":"SyFi","type":"remote","platform":"multiple","port":null,"verified":false,"codes":["CVE-2018-4878"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":44744,"kind":"exploit","title":"Flash ActiveX 28.0.0.137 - Code Execution (1)","url":"https://www.exploit-db.com/exploits/44744","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/44744.txt","file":"exploits/windows/local/44744.txt","published":"2016-02-16","added":"2018-05-24","updated":"2018-05-24","author":"smgorelik","type":"local","platform":"windows","port":null,"verified":false,"codes":["CVE-2018-4878"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/smgorelik/Windows-RCE-exploits/tree/722e4b96a91afdb9b9b11a9354a5a1625fcf1d53/Documents/Office%2BFlash#cve-2018-4878-flash-exploit"},{"edbId":44745,"kind":"exploit","title":"Flash ActiveX 28.0.0.137 - Code Execution (2)","url":"https://www.exploit-db.com/exploits/44745","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/44745.txt","file":"exploits/windows/local/44745.txt","published":"2016-02-13","added":"2018-05-24","updated":"2018-05-24","author":"smgorelik","type":"local","platform":"windows","port":null,"verified":false,"codes":["CVE-2018-4878"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/smgorelik/Windows-RCE-exploits/tree/722e4b96a91afdb9b9b11a9354a5a1625fcf1d53/Documents/Office%2BFlash#cve-2018-4878-flash-exploit"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html","tags":["Technical Description","Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"http://www.securityfocus.com/bid/102893","tags":["Broken Link"],"source":"psirt@adobe.com"},{"url":"http://www.securitytracker.com/id/1040318","tags":["Broken Link"],"source":"psirt@adobe.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0285","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://github.com/vysec/CVE-2018-4878","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb18-03.html","tags":["Vendor Advisory"],"source":"psirt@adobe.com"},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/","tags":["Exploit","Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139","tags":["Press/Media Coverage","Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://www.exploit-db.com/exploits/44412/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"psirt@adobe.com"},{"url":"https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html","tags":["Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets","tags":["Technical Description","Third Party Advisory"],"source":"psirt@adobe.com"},{"url":"http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html","tags":["Technical Description","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/102893","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1040318","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0285","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/vysec/CVE-2018-4878","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb18-03.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139","tags":["Press/Media Coverage","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44412/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets","tags":["Technical Description","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["Issue Tracking"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878","tags":["Third Party Advisory","US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-4878","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}