Actively exploited in the wild
Adobe Flash Player Use-After-Free Vulnerability
Adobe - Flash Player · Listed in the CISA KEV since 2022-02-15. This indicates confirmed attacks in production environments.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2018-15982
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code in the context of the browser, potentially leading to system compromise or data theft.
Recommendation
Update Flash Player to the latest available version or remove Flash Player entirely, as it is being deprecated.
Other vulnerabilities in Adobe Flash Player
See all- CVE-2017-3106High
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3085High
Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.
- CVE-2017-3099High
Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3074High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3073High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, leading to memory corruption. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3072High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3071High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when masking display objects. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3070High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3069High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.
- CVE-2017-3068High
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
Original NVD description (English source)
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS