CVE-2018-4944

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion...

9.8 CriticalFix available

CVE-2018-4944 is a critical vulnerability (CVSS 9.8) in Adobe Flash Player, published May 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.47%, the 95th percentile. Fixed in flash-player-plugin 29.0.0.171-1.mga6.nonfree.

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.47%Down 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: CVE-2018-4944
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-704
Updated: 2026-11-02

CVE List No score

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: CVE-2018-4944
Updated: 2026-11-02

EUVDEUVD-2018-16729 No score

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: EUVD-2018-16729
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w5rc-5jqm-p8hv 9.8

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion...

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: GHSA-w5rc-5jqm-p8hv
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-704
Updated: 2026-11-02

OSVRHSA-2018:1367 8.8

Red Hat Security Advisory: flash-plugin security update

Record: RHSA-2018:1367
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-4944 9.8

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Record: UBUNTU-CVE-2018-4944
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0233 No score

Updated flash-player-plugin packages fix security vulnerability

Adobe Flash Player 29.0.0.171 addresses a critical type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-4944).

Record: MGASA-2018-0233
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:6	before 29.0.0.171-1.mga6.nonfree	29.0.0.171-1.mga6.nonfree
`flash-plugin` Red Hat:rhel_extras:6	before 0:29.0.0.171-1.el6_9	0:29.0.0.171-1.el6_9
`flashplugin-nonfree` Ubuntu:14.04:LTS	before 29.0.0.171ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 45 moreShow less 11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.111.2.202.577ubuntu0.14.04.111.2.202.616ubuntu0.14.04.111.2.202.621ubuntu0.14.04.111.2.202.626ubuntu0.14.04.111.2.202.632ubuntu0.14.04.111.2.202.635ubuntu0.14.04.111.2.202.637ubuntu0.14.04.111.2.202.643ubuntu0.14.04.111.2.202.644ubuntu0.14.04.124.0.0.186ubuntu0.14.04.124.0.0.194ubuntu0.14.04.1	29.0.0.171ubuntu0.14.04.1
`flashplugin-nonfree` Ubuntu:16.04:LTS	before 29.0.0.171ubuntu0.16.04.1, plus listed versions 11.2.202.540ubuntu211.2.202.548ubuntu111.2.202.554ubuntu111.2.202.559ubuntu111.2.202.569ubuntu1 Show 29 moreShow less 11.2.202.577ubuntu111.2.202.616ubuntu111.2.202.621ubuntu0.16.04.111.2.202.626ubuntu0.16.04.111.2.202.632ubuntu0.16.04.111.2.202.635ubuntu0.16.04.111.2.202.637ubuntu0.16.04.111.2.202.643ubuntu0.16.04.111.2.202.644ubuntu0.16.04.124.0.0.186ubuntu0.16.04.124.0.0.194ubuntu0.16.04.124.0.0.221ubuntu0.16.04.125.0.0.127ubuntu0.16.04.125.0.0.148ubuntu0.16.04.125.0.0.171ubuntu0.16.04.126.0.0.126ubuntu0.16.04.126.0.0.131ubuntu0.16.04.126.0.0.137ubuntu0.16.04.126.0.0.151ubuntu0.16.04.127.0.0.130ubuntu0.16.04.127.0.0.159ubuntu0.16.04.127.0.0.170ubuntu0.16.04.127.0.0.183ubuntu0.16.04.127.0.0.187ubuntu0.16.04.128.0.0.126ubuntu0.16.04.128.0.0.137ubuntu0.16.04.128.0.0.161ubuntu0.16.04.129.0.0.113ubuntu0.16.04.129.0.0.140ubuntu0.16.04.1	29.0.0.171ubuntu0.16.04.1
`flashplugin-nonfree` Ubuntu:18.04:LTS	before 29.0.0.171ubuntu1, plus listed versions 27.0.0.170ubuntu127.0.0.187ubuntu128.0.0.126ubuntu128.0.0.137ubuntu128.0.0.161ubuntu1 Show 4 moreShow less 28.0.0.161ubuntu228.0.0.161ubuntu329.0.0.113ubuntu129.0.0.140ubuntu1	29.0.0.171ubuntu1