CVE-2018-4919

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free...

8.8 HighFix available

CVE-2018-4919 is a high vulnerability (CVSS 8.8) in Adobe Flash Player, published April 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.36%, the 94th percentile. Fixed in flash-player-plugin 29.0.0.113-1.mga6.nonfree.

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

7.36%Down 0.6 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: CVE-2018-4919
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: CVE-2018-4919
Updated: 2026-11-02

EUVDEUVD-2018-16704 No score

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: EUVD-2018-16704
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4xhc-7xr7-f3hm 9.8

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free...

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: GHSA-4xhc-7xr7-f3hm
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVRHSA-2018:0520 8.8

Red Hat Security Advisory: flash-plugin security update

Record: RHSA-2018:0520
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-4919 8.8

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: UBUNTU-CVE-2018-4919
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0189 No score

Updated flash-player-plugin packages fix security vulnerability

It was found that flash versions older than 29.0.0.113 contained a use after free vulnerability that could lead to remote code execution (CVE-2018-4919).

A second vulnerability was a type confusion which could also lead to remote code execution (CVE-2018-4920).

Record: MGASA-2018-0189
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:6	before 29.0.0.113-1.mga6.nonfree	29.0.0.113-1.mga6.nonfree
`flash-plugin` Red Hat:rhel_extras:6	before 0:29.0.0.113-1.el6_9	0:29.0.0.113-1.el6_9
`flashplugin-nonfree` Ubuntu:14.04:LTS	before 29.0.0.140ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less 11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1	29.0.0.140ubuntu0.14.04.1
`flashplugin-nonfree` Ubuntu:16.04:LTS	before 29.0.0.140ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 28 moreShow less 11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.1	29.0.0.140ubuntu0.16.04.1