CVE-2018-4878highunder attackransomwareCWE-416

CVE-2018-4878: high-severity vulnerability in Adobe Flash Player before 28.0.0.161

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 2 threat group(s) use it.

ssvc Actcvss 7.8epss 90%
from disclosure to weaponsame day
Published on NVDFeb 6
1st PoCFeb 13
CISA KEV+1366d
Who exploits it — 2

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT37🇰🇵 MITRE ATT&CK
APT / StateLazarus Group🇰🇵 MITRE ATT&CK
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-05-03

The impacted product is end-of-life and should be disconnected if still in use.

In short

Adobe Flash Player had a memory flaw where it tried to use data that was already deleted, allowing attackers to run malicious code on your computer. This vulnerability was actively exploited by hackers in early 2018.

Technical detail

A use-after-free vulnerability in Adobe Flash Player's Primetime SDK media player component allows remote code execution through a dangling pointer in listener object handling. The attack vector is typically through malicious media content, and successful exploitation requires the victim to interact with crafted content in a vulnerable Flash context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · Adobe Flash Player before 28.0.0.161
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.