CVE-2018-15983
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library...
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
- Record
CVE-2018-15983- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-426
- Updated
- 2026-11-02
CVE List No score
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
- Record
CVE-2018-15983- Updated
- 2026-11-02
EUVDEUVD-2018-7839 No score
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
- Record
EUVD-2018-7839- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c2xf-g8c5-v9p9
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library...
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
- Record
GHSA-c2xf-g8c5-v9p9- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-15983
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
- Record
UBUNTU-CVE-2018-15983- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0478 No score
Updated flash-player-plugin packages fix security vulnerability
Use after free flaw enabling arbitrary code execution. (CVE-2018-15982)
Insecure Library Loading (DLL hijacking) flaw enabling privilege escalation. (CVE-2018-15983)
- Record
MGASA-2018-0478- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:6 From an advisory covering 2 CVEs |
before 32.0.0.101-1.mga6.nonfree | 32.0.0.101-1.mga6.nonfree |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 32.0.0.101ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1 |
32.0.0.101ubuntu0.14.04.1 |
flashplugin-nonfreeUbuntu:16.04:LTS |
before 32.0.0.101ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 37 moreShow less11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.129.0.0.171ubuntu0.16.04.130.0.0.113ubuntu0.16.04.130.0.0.134ubuntu0.16.04.130.0.0.154ubuntu0.16.04.131.0.0.108ubuntu0.16.04.131.0.0.122ubuntu0.16.04.131.0.0.148ubuntu0.16.04.131.0.0.153ubuntu0.16.04.1 |
32.0.0.101ubuntu0.16.04.1 |
flashplugin-nonfreeUbuntu:18.04:LTS |
before 32.0.0.101ubuntu0.18.04.1, plus listed versions 27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1 Show 12 moreShow less28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu129.0.0.171ubuntu130.0.0.113ubuntu0.18.04.130.0.0.134ubuntu0.18.04.130.0.0.154ubuntu0.18.04.131.0.0.108ubuntu0.18.04.131.0.0.122ubuntu0.18.04.131.0.0.148ubuntu0.18.04.131.0.0.153ubuntu0.18.04.1 |
32.0.0.101ubuntu0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-15983 is a high vulnerability (CVSS 7.8) in Adobe Flash Player, published December 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in flashplugin-nonfree 32.0.0.101ubuntu0.14.04.1.
References
helpx.adobe.com/security/products/flash-player/apsb18-42.html
securityfocus.com/bid/106108
nvd.nist.gov/vuln/detail/CVE-2018-15983
github.com/advisories/GHSA-c2xf-g8c5-v9p9
advisories.mageia.org/MGASA-2018-0478.html
bugs.mageia.org/show_bug.cgi?id=23950
ubuntu.com/security/CVE-2018-15983
cve.org/CVERecord?id=CVE-2018-15983
Left out here: 26 versions. The JSON record has them.