CVE-2018-15981

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful...

9.8 CriticalFix available

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

11.7%Up 3.8 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Record: CVE-2018-15981
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-704
Updated: 2026-11-02

CVE List No score

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Record: CVE-2018-15981
Updated: 2026-11-02

EUVDEUVD-2018-7837 No score

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Record: EUVD-2018-7837
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j8f5-p7w2-6843 9.8

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful...

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Record: GHSA-j8f5-p7w2-6843
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-704
Updated: 2026-11-02

OSVRHSA-2018:3644 8.8

Red Hat Security Advisory: flash-plugin security update

Record: RHSA-2018:3644
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0467 No score

Updated flash-player-plugin packages fix security vulnerability

A critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user. (CVE-2018-15981)

Record: MGASA-2018-0467
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:6	before 31.0.0.153-1.mga6.nonfree	31.0.0.153-1.mga6.nonfree
`flash-plugin` Red Hat:rhel_extras:6	before 0:31.0.0.153-1.el6_10	0:31.0.0.153-1.el6_10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-15981 is a critical vulnerability (CVSS 9.8) in Adobe Flash Player, published November 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.7%, the 96th percentile. Fixed in flash-player-plugin 31.0.0.153-1.mga6.nonfree.

References

Show 7 moreShow less