CVE-2018-4878 Adobe Flash Player Use-After-Free
A use-after-free flaw in Adobe Flash Player allows attackers to execute arbitrary code via malicious media content, requiring an upgrade to the latest version.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-4878?
CVE-2018-4878 is a high-severity use after free vulnerability in Adobe Flash Player, published on 6 Feb 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
Weakness: CWE-416
Which versions are affected by CVE-2018-4878?
It affects 4 products.
Products include Adobe Flash Player, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2018-4878?
Upgrade to a fixed version. US federal agencies must fix it by 3 May 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-4878 being exploited?
Yes. Attackers have exploited CVE-2018-4878 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 3 Exploit-DB entries and 10 proofs of concept on GitHub.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-2rf4-mpg3-phjw, UBUNTU-CVE-2018-4878.