CVE-2018-15982
KEV RANSOMWAREHIGH 7.8EPSS 89.6%
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 89.58% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-02-15, used in ransomware campaigns
- Published
- 2019-01-18
- Updated
- 2026-10-01
Proof-of-concept exploits (9)
- FlatL1neAPT/CVE-2018-159820★ · 2018-12-05
- JasonLOU/CVE_2018_159820★ · 2019-06-27
- Ormicron/CVE-2018-15982_PoC13★ · 2019-11-06
- Ridter/CVE-2018-15982_EXP178★ · 2019-01-04
- SyFi/CVE-2018-159825★ · 2018-12-20
- jas502n/CVE-2018-15982_EXP_IE12★ · 2018-12-12
- kphongagsorn/adobe-flash-cve2018-1598211★ · 2020-08-12
- qiantu88/2018-cve0★ · 2019-01-05
- scanfsec/CVE-2018-1598229★ · 2019-12-07
ExploitDB entries (1)
Security advisories
- https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
- http://www.securityfocus.com/bid/106116
- https://access.redhat.com/errata/RHSA-2018:3795
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15982
- cisagov/vulnrichment/issues/195