CVE-2018-5002: Adobe Flash Player Stack-Based Buffer Overflow Enables Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows arbitrary code execution, is confirmed exploited in CISA KEV, and affects an end-of-life product that may still be present in some environments.

What it is

Adobe Flash Player 29.0.0.171 and earlier contain a stack-based buffer overflow (CWE-121/CWE-787) that can be triggered during content processing. Successful exploitation allows arbitrary code execution in the context of the current user. Because Flash Player is end-of-life, any remaining deployment carries unmitigated risk.

Impact

An attacker who triggers the overflow gains arbitrary code execution with the privileges of the user running Flash Player. That can lead to full compromise of the user's session, data theft, or further lateral movement.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the victim must open or render malicious Flash content. No authentication is needed, but the user must be induced to load the crafted file or page.

Exploitation

CVE-2018-5002 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-23), confirming real-world exploitation. EPSS gives a 30-day exploitation probability of roughly 25% (98th percentile), and the record shows no documented ransomware use.

What to do

• Patch or remove Flash Player immediately; Adobe's APSB18-19 advisory is the vendor fix, but Flash is end-of-life and should be uninstalled where possible.
• Follow CISA KEV guidance: disconnect end-of-life Flash deployments from networks if they cannot be removed.
• Block Flash content in browsers and email gateways, and disable the Flash plugin enterprise-wide.
• Apply Red Hat errata RHSA-2018:1827 for affected Enterprise Linux packages.
• Restrict user ability to open untrusted SWF or web content that embeds Flash.

Detection

• Monitor for Flash Player process crashes or abnormal child processes spawned from browser or Flash plugin processes.
• Hunt for SWF files or web content loading from untrusted or newly registered domains in proxy and endpoint logs.
• Alert on execution of Flash Player binaries (e.g., FlashPlayerPlugin, npapi) after the end-of-life cutoff date.
• Review endpoint telemetry for stack-based overflow indicators such as access violations in Flash Player modules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.