CVE-2018-4871

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This...

7.5 HighFix available

CVE-2018-4871 is a high vulnerability (CVSS 7.5) in Adobe Flash Player, published January 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.51%, the 92nd percentile. Fixed in flash-player-plugin 28.0.0.137-1.mga6.nonfree.

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

5.51%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2018-4871
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-4871
Updated: 2026-11-02

EUVDEUVD-2018-16656 No score

Record: EUVD-2018-16656
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jhfm-prjw-6726 7.5

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This...

Record: GHSA-jhfm-prjw-6726
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

OSVRHSA-2018:0081 6.5

Red Hat Security Advisory: flash-plugin security update

Record: RHSA-2018:0081
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2018-0072 No score

Updated flash-player-plugin package fixes security vulnerability

Adobe Flash Player 28.0.0.137 addresses an important out-of-bounds read vulnerability that could lead to information exposure (CVE-2018-4871).

Record: MGASA-2018-0072
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:6	before 28.0.0.137-1.mga6.nonfree	28.0.0.137-1.mga6.nonfree
`flash-plugin` Red Hat:rhel_extras:6	before 0:28.0.0.137-1.el6_9	0:28.0.0.137-1.el6_9

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less