CVE-2018-12827
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful...
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
CVE-2018-12827- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
CVE-2018-12827- Updated
- 2026-11-02
EUVDEUVD-2018-4780 No score
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
EUVD-2018-4780- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pcm-5j39-vg9p
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful...
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
GHSA-5pcm-5j39-vg9p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHSA-2018:2435
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2018:2435- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-12827
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Record
UBUNTU-CVE-2018-12827- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0349 No score
Updated flash-player-plugin packages fix security vulnerabilities
Updated flash-player-plugin packages fix security vulnerabilities:
- Out-of-bounds read that can lead to Information Disclosure (CVE-2018-12824, CVE-2018-12826, CVE-2018-12827)
- Security bypass that can lead to Security Mitigation Bypass (CVE-2018-12825)
- Use of a component with a known vulnerability can lead to a Privilege Escalation (CVE-2018-12828)
- Record
MGASA-2018-0349- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 From an advisory covering 5 CVEs |
before 30.0.0.154-1.mga6.nonfree | 30.0.0.154-1.mga6.nonfree |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 0:30.0.0.154-1.el6_10 | 0:30.0.0.154-1.el6_10 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 30.0.0.154ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1 |
30.0.0.154ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 30.0.0.154ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 32 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.129.0.0.171ubuntu0.16.04.130.0.0.113ubuntu0.16.04.130.0.0.134ubuntu0.16.04.1 |
30.0.0.154ubuntu0.16.04.1 |
flashplugin-nonfreeUbuntu:18.04:LTS |
before 30.0.0.154ubuntu0.18.04.1, plus listed versions 27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1 Show 7 moreShow less28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu129.0.0.171ubuntu130.0.0.113ubuntu0.18.04.130.0.0.134ubuntu0.18.04.1 |
30.0.0.154ubuntu0.18.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe Flash - AVC Processing Out-of-Bounds Read | 2018-08-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-12827 is a high vulnerability (CVSS 7.5) in Adobe Flash Player, published August 19, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 31.7%, the 98th percentile. Fixed in flashplugin-nonfree 30.0.0.154ubuntu0.14.04.1.
References
securityfocus.com/bid/105066
exploit-db.com/exploits/45268
access.redhat.com/errata/RHSA-2018:2435
securitytracker.com/id/1041448
helpx.adobe.com/security/products/flash-player/apsb18-25.html
nvd.nist.gov/vuln/detail/CVE-2018-12827
Show 24 moreShow less
github.com/advisories/GHSA-5pcm-5j39-vg9p
advisories.mageia.org/MGASA-2018-0349.html
bugs.mageia.org/show_bug.cgi?id=23464
bugzilla.redhat.com/show_bug.cgi?id=1616026
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2435.json
cve.org/CVERecord?id=CVE-2018-12824
ubuntu.com/security/CVE-2018-12827
rhn.redhat.com/errata/RHSA-2018-2435.html
Left out here: 21 versions. The JSON record has them.