Every CVE Search/ Get API key

CVE-2018-15982

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free...

7.8 HighIn KEVPublic exploitFix available

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

89.6%Up 61.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Record
CVE-2018-15982
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-416
Updated
2026-11-02
CVE List 7.8

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Record
CVE-2018-15982
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2018-7838 7.8

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Record
EUVD-2018-7838
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-26v8-ffh8-7vqg 9.8

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free...

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Record
GHSA-26v8-ffh8-7vqg
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CISA KEV No score

Adobe Flash Player Use-After-Free Vulnerability

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

Record
CVE-2018-15982
Weakness
CWE-416
Updated
2026-11-02
OSVRHSA-2018:3795 8.8

Red Hat Security Advisory: flash-plugin security update

Record
RHSA-2018:3795
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-15982 7.8

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Record
UBUNTU-CVE-2018-15982
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0478 No score

Updated flash-player-plugin packages fix security vulnerability

Use after free flaw enabling arbitrary code execution. (CVE-2018-15982)

Insecure Library Loading (DLL hijacking) flaw enabling privilege escalation. (CVE-2018-15983)

Record
MGASA-2018-0478
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-player-plugin
Mageia:6
From an advisory covering 2 CVEs
 before 32.0.0.101-1.mga6.nonfree
32.0.0.101-1.mga6.nonfree
flash-plugin
Red Hat:rhel_extras:6
 before 0:32.0.0.101-1.el6_10
0:32.0.0.101-1.el6_10
flashplugin-nonfree
Ubuntu:14.04:LTS
 before 32.0.0.101ubuntu0.14.04.1, plus listed versions
11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1
Show 45 moreShow less
11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1
32.0.0.101ubuntu0.14.04.1
flashplugin-nonfree
Ubuntu:16.04:LTS
 before 32.0.0.101ubuntu0.16.04.1, plus listed versions
11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1
Show 37 moreShow less
11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.129.0.0.171ubuntu0.16.04.130.0.0.113ubuntu0.16.04.130.0.0.134ubuntu0.16.04.130.0.0.154ubuntu0.16.04.131.0.0.108ubuntu0.16.04.131.0.0.122ubuntu0.16.04.131.0.0.148ubuntu0.16.04.131.0.0.153ubuntu0.16.04.1
32.0.0.101ubuntu0.16.04.1
flashplugin-nonfree
Ubuntu:18.04:LTS
 before 32.0.0.101ubuntu0.18.04.1, plus listed versions
27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1
Show 12 moreShow less
28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu129.0.0.171ubuntu130.0.0.113ubuntu0.18.04.130.0.0.134ubuntu0.18.04.130.0.0.154ubuntu0.18.04.131.0.0.108ubuntu0.18.04.131.0.0.122ubuntu0.18.04.131.0.0.148ubuntu0.18.04.131.0.0.153ubuntu0.18.04.1
32.0.0.101ubuntu0.18.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubFlatL1neAPT/CVE-2018-159822018-12-05
PoC in GitHubOrmicron/CVE-2018-15982_PoC2018-12-06
PoC in GitHubRidter/CVE-2018-15982_EXP2018-12-10
PoC in GitHubkphongagsorn/adobe-flash-cve2018-159822018-12-11
PoC in GitHubjas502n/CVE-2018-15982_EXP_IE2018-12-12
PoC in GitHubscanfsec/CVE-2018-159822018-12-12
PoC in GitHubSyFi/CVE-2018-159822018-12-20
Exploit-DBAdobe Flash ActiveX Plugin 28.0.0.137 - Remote Code Execution (PoC)2018-12-24

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-15982 is a high vulnerability (CVSS 7.8) in Adobe Flash Player, published December 7, 2018. CISA lists it as known to be exploited, since February 15, 2022. EUVD reports exploitation since February 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 89.6%, the 99th percentile. Fixed in flash-plugin 0:32.0.0.101-1.el6_10.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 26 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open