CVE-2018-4878: Adobe Flash Player Primetime SDK use-after-free enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe vulnerability is confirmed exploited in the wild, listed in CISA KEV with known ransomware campaign use, and has an EPSS probability above 0.89, while the affected product is end-of-life.

What it is

Adobe Flash Player before 28.0.0.161 contains a use-after-free (CWE-416) caused by a dangling pointer in the Primetime SDK when handling media player listener objects. Successful exploitation allows arbitrary code execution, and the flaw was exploited in the wild in January and February 2018.

Impact

An attacker can execute arbitrary code in the context of the affected Flash Player process, leading to full compromise of confidentiality, integrity and availability on the victim host.

Attack surface

Reached locally with user interaction required (CVSS vector AV:L/AC:L/PR:N/UI:R), typically by opening a crafted document or media file that loads malicious Flash content; no authentication is needed.

Exploitation

Exploitation is confirmed in the wild and the CVE is listed in CISA KEV (added 2021-11-03, known ransomware campaign use), with a very high EPSS 30-day probability of 0.89532 (99.779th percentile) and multiple references tagged Exploit.

What to do

• Patch or remove Flash Player; upgrade to 28.0.0.161 or later where still supported.
• Because Flash Player is end-of-life, disconnect or uninstall it from systems that no longer require it, per CISA KEV required action.
• Block Flash content in browsers and email clients, and disable Flash plugin execution via policy.
• Apply vendor errata for affected Red Hat Enterprise Linux packages (e.g., RHSA-2018:0285).
• Restrict execution of untrusted documents and media files through application allowlisting and email attachment filtering.

Detection

• Monitor for Flash Player processes spawning child processes such as cmd.exe, powershell.exe or scripting hosts.
• Hunt for Office documents or media files containing embedded Flash objects or SWF content delivered via email or web downloads.
• Detect known exploit artifacts and loader behavior using the public exploit and malware sample references (ExploitDB 44412, InQuest malware samples).
• Alert on Flash Player crashes or abnormal memory access patterns consistent with use-after-free exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.