ZeroDay Findings
Sign inSign up

Findings

CVE-2018-4878

Adobe Flash Player Use-After-Free Vulnerability

Published Feb 6, 2018 · updated Jun 16, 2026 · adobe flash player

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 6, 2018 · Catalog

    Detected

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. May 3, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date May 3, 2022

Affected

  • cpe adobe/flash playerversion unspecified
  • cpe redhat/enterprise linux desktop6.0
  • cpe redhat/enterprise linux server6.0
  • cpe redhat/enterprise linux workstation6.0
  • vendor Adobe Flash Playerversion unspecified

Sources

  • CISA KEVCVE-2018-4878

    Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

    cisa.gov
  • CVE.orgCVE-2018-4878

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-4878

    30-day exploitation probability 89.5%

    first.org
  • Exploit Database44412

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database44744

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database44745

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2018-4878

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was

    nvd.nist.gov

References