Actively exploited · Published Jan 18, 2019 · Assigned by adobe
CVE-2018-15982
High 7.8 Exploited Ransomware
In plain English
A high-severity use-after-free in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on February 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 89.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Aug 15, 2022.
Official description
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2018:3795 vendor-advisory, x_refsource_REDHAT
- https://helpx.adobe.com/security/products/flash-player/apsb18-42.html x_refsource_CONFIRM
- 46051 exploit, x_refsource_EXPLOIT-DB
- 106116 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15982 government-resource
- https://github.com/cisagov/vulnrichment/issues/195 issue-tracking