CVE-2018-4878

🗓️ 06 Feb 2018 20:00:00Reported by adobeType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 1522 Views🌐 WEB

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution

Reporter	Title	Published	Views	Family All 134
GithubExploit	Exploit for Use After Free in Adobe Flash_Player	4 Apr 201804:33	–	githubexploit
GithubExploit	Exploit for Use After Free in Adobe Flash_Player	10 Feb 201809:30	–	githubexploit
GithubExploit	Exploit for Use After Free in Adobe Flash_Player	9 Feb 201813:30	–	githubexploit
GithubExploit	Exploit for Use After Free in Adobe Flash_Player	10 Feb 201809:30	–	githubexploit
GithubExploit	Exploit for Race Condition in Canonical Ubuntu_Linux	16 Mar 202617:11	–	githubexploit
0day.today	Adobe Flash 28.0.0.137 Remote Code Execution Exploit	4 Apr 201800:00	–	zdt
0day.today	Flash ActiveX 28.0.0.137 - Code Execution Exploit (1)	24 May 201800:00	–	zdt
0day.today	Flash ActiveX 28.0.0.137 - Code Execution Exploit (2)	24 May 201800:00	–	zdt
Tenable Nessus	Flash Player < 28.0.0.161 Multiple RCE (APSB18-03)	20 Mar 201900:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 28.0.0.137 Use-after-free Remote Code Execution (APSA18-01) (APSB18-03)	5 Feb 201800:00	–	nessus

NVD

Vulners

Node

AND

adobe flash_playerRange<28.0.0.161

apple macosMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

Node

redhat enterprise_linux_desktopMatch6.0

redhat enterprise_linux_serverMatch6.0

redhat enterprise_linux_workstationMatch6.0

Node

AND

adobe flash_playerRange<28.0.0.161edge

adobe flash_playerRange<28.0.0.161internet_explorer_11

microsoft windows_10

microsoft windows_8.1

Node

AND

adobe flash_playerRange<28.0.0.161chrome

apple macosMatch-

google chrome_osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "product": "Adobe Flash Player before 28.0.0.161",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Adobe Flash Player before 28.0.0.161"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/102893
securingtomorrow	www.securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/
github	www.github.com/vysec/CVE-2018-4878
blog	www.blog.talosintelligence.com/2018/02/group-123-goes-wild.html
trendmicro	www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets
github	www.github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day
helpx	www.helpx.adobe.com/security/products/flash-player/apsb18-03.html
darkreading	www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139
fireeye	www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html
exploit-db	www.exploit-db.com/exploits/44412/

Parameter	Position	Path	Description	CWE
conf/product_old.jpg	path	/conf/product_old.jpg	Payload delivery URL used to fetch shellcode/ROKRAT payload.	CWE-416
design/m/images/image/image.php	path	/design/m/images/image/image.php	Payload payload URL in exploit chain used to download and execute droppped malware.	CWE-416
main/local.php	path	/main/local.php	Payload hosting URL used in campaign to exfiltrate payload.	CWE-416
admincenter/files/board/4/manager.php	path	/admincenter/files/board/4/manager.php	Payload host URL used to deliver ROKRAT component.	CWE-416

17 Jun 2026 01:59Current

8.8High risk

Vulners AI Score8.8

CVSS 27.5

CVSS 3.17.8

EPSS0.89532

SSVC