{"schemaVersion":3,"id":"CVE-2018-4878","aliases":["UBUNTU-CVE-2018-4878"],"status":"published","duplicateOf":null,"title":"Adobe Flash Player Use-After-Free Vulnerability","description":"A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.","dates":{"published":"2018-02-06T20:00:00.000Z","modified":"2025-11-17T19:33:19.689Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.89532,"percentile":0.99788,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.89532},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.89532,"percentile":0.99788}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.89532,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.89532,"percentile":0.99788}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player Use-After-Free Vulnerability","description":"Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-4878","label":"nvd.nist.gov/vuln/detail/CVE-2018-4878"}],"vendor":"Adobe","product":"Flash Player","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player Use-After-Free Vulnerability","description":"Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-4878","label":"nvd.nist.gov/vuln/detail/CVE-2018-4878"}],"vendor":"Adobe","product":"Flash Player","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"REF_3C4ED802AAAEBCEC","name":"Exploit Reference (securingtomorrow.mcafee.com)","source":"reference","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"44412","name":"Adobe Flash < 28.0.0.161 - Use-After-Free","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44412","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/44412.py","codes":["CVE-2018-4878"]},"metasploit":null},{"id":"44744","name":"Flash ActiveX 28.0.0.137 - Code Execution (1)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44744","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"local","platform":"windows","file":"exploits/windows/local/44744.txt","codes":["CVE-2018-4878"]},"metasploit":null},{"id":"44745","name":"Flash ActiveX 28.0.0.137 - Code Execution (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44745","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"local","platform":"windows","file":"exploits/windows/local/44745.txt","codes":["CVE-2018-4878"]},"metasploit":null}],"exploitCount":4,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"adobe","product":"flash_player","name":"Flash Player","label":"flash_player","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 28.0.0.161","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.0.161","eol":null,"hubHref":"/vendor/adobe/flash_player"},{"vendor":"ubuntu","product":"flashplugin-nonfree","name":"flashplugin-nonfree","label":"flashplugin-nonfree","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/flashplugin-nonfree","purlType":"deb","versions":[{"text":"< 28.0.0.161ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 28.0.0.161ubuntu0.16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.0.161ubuntu0.14.04.1 | < 28.0.0.161ubuntu0.16.04.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"enterprise_linux_desktop","name":"enterprise linux desktop","label":"enterprise_linux_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server","name":"enterprise linux server","label":"enterprise_linux_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation","name":"enterprise linux workstation","label":"enterprise_linux_workstation","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_workstation"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html","label":"blog.talosintelligence.com/2018/02/group-123-goes-wild.html","hostname":"blog.talosintelligence.com","tags":["X Refsource MISC","Technical Description","Third Party Advisory"]},{"url":"https://threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/","label":"threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/","hostname":"threatpost.com","tags":["X Refsource MISC","Third Party Advisory","REPORT"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb18-03.html","label":"helpx.adobe.com/security/products/flash-player/apsb18-03.html","hostname":"helpx.adobe.com","tags":["X Refsource MISC","Vendor Advisory","REPORT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0285","label":"access.redhat.com/errata/RHSA-2018:0285","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040318","label":"www.securitytracker.com/id/1040318","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link"]},{"url":"http://www.securityfocus.com/bid/102893","label":"www.securityfocus.com/bid/102893","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link"]},{"url":"https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html","label":"www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html","hostname":"www.fireeye.com","tags":["X Refsource MISC","Third Party Advisory","REPORT"]},{"url":"https://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign","label":"blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign","hostname":"blog.morphisec.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139","label":"www.darkreading.com/threat-intelligence/…","hostname":"www.darkreading.com","tags":["X Refsource MISC","Press/Media Coverage","Third Party Advisory"]},{"url":"https://github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day","label":"github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets","label":"www.trendmicro.com/vinfo/…","hostname":"www.trendmicro.com","tags":["X Refsource MISC","Technical Description","Third Party Advisory","REPORT"]},{"url":"https://github.com/vysec/CVE-2018-4878","label":"github.com/vysec/CVE-2018-4878","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/","label":"securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/","hostname":"securingtomorrow.mcafee.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44412/","label":"www.exploit-db.com/exploits/44412/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878","hostname":"www.cisa.gov","tags":["Government Resource","Third Party Advisory","US Government Resource"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","label":"github.com/cisagov/vulnrichment/issues/196","hostname":"github.com","tags":["Issue Tracking"]},{"url":"https://ubuntu.com/security/CVE-2018-4878","label":"ubuntu.com/security/CVE-2018-4878","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4878","label":"www.cve.org/CVERecord?id=CVE-2018-4878","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["MGASA-2018-0120","RHSA-2018:0285"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-02-06T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe Flash Player Use-After-Free Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"The impacted product is end-of-life and should be disconnected if still in use.","source":"cisa"},{"kind":"modified","date":"2025-11-17T19:33:19.689Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:18:41.819Z","stale":false,"partial":false}}