Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2018-02-06

CVE-2018-4878

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

  1. First PoC
  2. 3899 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
90%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

3 known · links only

Exploit-DB3

  1. Flash ActiveX 28.0.0.137 - Code Execution (2) ↗

    created 2016-02-13

  2. Flash ActiveX 28.0.0.137 - Code Execution (1) ↗

    created 2016-02-16

  3. Adobe Flash < 28.0.0.161 - Use-After-Free ↗

    created 2018-04-06

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.