CVE-2018-4878
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This...
CVE-2018-4878 is a high vulnerability (CVSS 7.8) in Adobe Flash Player, published February 6, 2018. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.3%, the 99th percentile. Fixed in flash-player-plugin 28.0.0.161-1.mga6.nonfree.
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- Record
CVE-2018-4878- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- Record
CVE-2018-4878- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2018-16663
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- Record
EUVD-2018-16663- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2rf4-mpg3-phjw
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This...
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- Record
GHSA-2rf4-mpg3-phjw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Adobe Flash Player Use-After-Free Vulnerability
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
- Record
CVE-2018-4878- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRHSA-2018:0285
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2018:0285- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-4878
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- Record
UBUNTU-CVE-2018-4878- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0120 No score
Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 28.0.0.161 addresses critical use-after-free vulnerabilities that could lead to remote code execution (CVE-2018-4877, CVE-2018-4878). Successful exploitation could potentially allow an attacker to take control of the affected system.
Adobe is aware of a report that an exploit for CVE-2018-4878 exists in the wild, and is being used in limited, targeted attacks against Windows users. These attacks leverage Office documents with embedded malicious Flash content distributed via email.
- Record
MGASA-2018-0120- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 |
before 28.0.0.161-1.mga6.nonfree | 28.0.0.161-1.mga6.nonfree |
flash-pluginRed Hat:rhel_extras:6 |
before 0:28.0.0.161-1.el6_9 | 0:28.0.0.161-1.el6_9 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 28.0.0.161ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1 |
28.0.0.161ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 28.0.0.161ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 26 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.1 |
28.0.0.161ubuntu0.16.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Flash ActiveX 28.0.0.137 - Code Execution (2) | 2016-02-13 |
| Exploit-DB | Flash ActiveX 28.0.0.137 - Code Execution (1) | 2016-02-16 |
| PoC in GitHub | ydl555/CVE-2018-4878- | 2018-01-20 |
| PoC in GitHub | demonsec666/CVE-2018-4878 | 2018-02-09 |
| PoC in GitHub | tsondt/CVE-2018-4878 | 2018-02-09 |
| PoC in GitHub | vysecurity/CVE-2018-4878 | 2018-02-10 |
| PoC in GitHub | KathodeN/CVE-2018-4878 | 2018-02-23 |
| PoC in GitHub | SyFi/CVE-2018-4878 | 2018-04-04 |
| Exploit-DB | Adobe Flash < 28.0.0.161 - Use-After-Free | 2018-04-06 |
| PoC in GitHub | B0fH/CVE-2018-4878 | 2018-10-17 |
| PoC in GitHub | Yable/CVE-2018-4878 | 2018-12-19 |
| PoC in GitHub | HuanWoWeiLan/SoftwareSystemSecurity-2019 | 2019-07-17 |
| PoC in GitHub | lvyoshino/CVE-2018-4878 | 2021-04-30 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | exploitation, exploits | |
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
References
blog.talosintelligence.com/2018/02/group-123-goes-wild.html
threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742
helpx.adobe.com/security/products/flash-player/apsb18-03.html
access.redhat.com/errata/RHSA-2018:0285
securitytracker.com/id/1040318
securityfocus.com/bid/102893
Show 24 moreShow less
fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html
blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign
darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139
github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day
trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets
securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism
exploit-db.com/exploits/44412
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878
nvd.nist.gov/vuln/detail/CVE-2018-4878
advisories.mageia.org/MGASA-2018-0120.html
bugs.mageia.org/show_bug.cgi?id=22534
bugzilla.redhat.com/show_bug.cgi?id=1541981
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0285.json
cve.org/CVERecord?id=CVE-2018-4877
ubuntu.com/security/CVE-2018-4878
Left out here: 15 versions. The JSON record has them.