CVE-2018-4878KEV · OVERDUE

Adobe Flash Player Use-After-Free Vulnerability

High · published February 6, 2018

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
90%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 A dangling pointer in Adobe Flash Player is a recipe for disaster—just as dangerous as a waiter carrying your order to the wrong table! ⚡ Picture a waiter who forgets to clear a table, leaving an empty plate behind. If someone else sits there and takes the plate, they could find a hidden surprise—a messed-up order that creates chaos! Similarly, this use-after-free vulnerability allows attackers to execute arbitrary code by exploiting a leftover pointer, creating mayhem in your system. With this vulnerability, an attacker could take control of your system, running their malicious code as if they were you! Imagine a cyber-intruder sneaking into your digital party, wreaking havoc by accessing sensitive data or even launching other attacks—absolutely devastating!

Put simply

Picture a waiter who forgets to clear a table, leaving an empty plate behind. If someone else sits there and takes the plate, they could find a hidden surprise—a messed-up order that creates chaos! Similarly, this use-after-free vulnerability allows attackers to execute arbitrary code by exploiting a leftover pointer, creating mayhem in your system. The use-after-free vulnerability in Adobe Flash Player, specifically in versions before 28.0.0.161, arises from improper handling of listener objects, allowing attackers to exploit dangling pointers and execute arbitrary code.

What to do

With this vulnerability, an attacker could take control of your system, running their malicious code as if they were you! Imagine a cyber-intruder sneaking into your digital party, wreaking havoc by accessing sensitive data or even launching other attacks—absolutely devastating! To protect yourself, immediately update Adobe Flash Player to version 28.0.0.161 or later. Ensure your applications utilizing this SDK are also patched. Regularly audit your software for outdated versions to keep those pesky vulnerabilities at bay! You've got this! With these steps, you'll be on the path to a more secure environment in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.89532 · 99.8th percentile
Published
2018-02-06T20:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 06 FEB 20:00Z
    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161
    cvelistv5