CVE-2018-4878
Adobe Flash Player Use-After-Free Vulnerability
Description
CVE-2018-4878 is a high-severity use after free vulnerability in Adobe Flash Player before version 28.0.0.161. The vulnerability exists due to a dangling pointer in the Primetime SDK related to media player handling of listener objects, allowing attackers to achieve arbitrary code execution. CVE-2018-4878 was actively exploited in the wild in January and February 2018, with North Korean threat actors leveraging it against South Korean targets. CISA has added this Adobe Flash Player vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.3% (99.8th percentile), exploitation is near certain. This vulnerability is also known to be used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | < 28.0.0.161 |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux workstation | 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html(Technical Description, Third Party Advisory)
- http://www.securityfocus.com/bid/102893(Broken Link)
- http://www.securitytracker.com/id/1040318(Broken Link)
- https://access.redhat.com/errata/RHSA-2018:0285(Third Party Advisory)
- https://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign(Third Party Advisory)
- https://github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day(Third Party Advisory)
- https://github.com/vysec/CVE-2018-4878(Third Party Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsb18-03.html(Vendor Advisory)
- https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/(Exploit, Third Party Advisory)
- https://threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/(Third Party Advisory)
- https://www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139(Press/Media Coverage, Third Party Advisory)
- https://www.exploit-db.com/exploits/44412/(Exploit, Third Party Advisory, VDB Entry)
- https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html(Third Party Advisory)
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets(Technical Description, Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/196(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
In Adobe Flash Player, the use after free vulnerability occurs when the Primetime SDK continues to reference a media player listener object after the memory has been freed. Once the memory is deallocated, it can be reallocated for other purposes, and when the dangling pointer is subsequently dereferenced, attackers can execute arbitrary code by controlling the contents of the freed memory region.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2018-4878 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious security threat. The vulnerability requires local access and user interaction to exploit, typically through a malicious document or web page that triggers the use after free condition in Flash Player. No authentication is required, and attack complexity is low, making it easy to exploit once a user opens a crafted file. Successful exploitation results in high impact across confidentiality, integrity, and availability, granting attackers full control over the affected system. The EPSS score of 93.3% indicates near-certain exploitation activity, and the vulnerability is known to be leveraged in ransomware campaigns, significantly elevating the risk to organizations still running end-of-life Flash Player installations.
Exploit Maturity
CVE-2018-4878 has extensive exploit maturity with confirmed active exploitation in the wild. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, and ransomware operators are known to leverage it. Public exploit code is available for CVE-2018-4878 via Exploit Database and additional proof-of-concept code is hosted on GitHub. North Korean threat actors exploited this vulnerability in targeted campaigns against South Korean organizations using malicious Word documents with embedded Flash content. The EPSS score of 93.3% (99.8th percentile) confirms near-certain exploitation activity, making immediate remediation critical for any remaining Flash Player deployments.
Remediation
- Disconnect and remove Adobe Flash Player immediately. As stated in the CISA KEV required action: the impacted product is end-of-life and should be disconnected if still in use. Flash Player reached end-of-life on December 31, 2020.
- Ensure all instances of Adobe Flash Player prior to version 28.0.0.161 have been uninstalled from all systems, including those bundled with Red Hat Enterprise Linux Desktop 6.0, Server 6.0, and Workstation 6.0.
- Block Flash content at the network perimeter by configuring web proxies and firewalls to prevent SWF file downloads and Flash-based content from being served to endpoints.
- Deploy browser policies that disable Flash Player plugins across all managed browsers and enforce click-to-play restrictions as a fallback.
- Conduct a threat hunt across endpoints for indicators of compromise associated with CVE-2018-4878 exploitation, including suspicious Word documents with embedded Flash objects and unusual process spawning from browser or Office processes.
Technical Details
CVE-2018-4878 is a use after free vulnerability in the Adobe Flash Player Primetime SDK, specifically in the handling of media player listener objects. When a listener object is freed but its pointer remains referenced by the Flash runtime, subsequent operations on the dangling pointer allow attackers to corrupt heap memory. The CVSS vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates that while the attack vector is local (requiring the user to open a malicious file), the attack complexity is low and no privileges are required beyond tricking a user into interaction. Exploitation was typically achieved through malicious Microsoft Word documents containing embedded Flash SWF objects that triggered the use after free condition, allowing attackers to execute shellcode with the privileges of the running process.
Frequently Asked Questions
Is CVE-2018-4878 being actively exploited?
Yes. CVE-2018-4878 has been actively exploited in the wild since January 2018, primarily by North Korean threat actors targeting South Korean organizations. CISA has confirmed active exploitation by listing it in the Known Exploited Vulnerabilities catalog, and the vulnerability is known to be used in ransomware campaigns.
What products are affected by CVE-2018-4878?
CVE-2018-4878 affects Adobe Flash Player versions prior to 28.0.0.161 across all platforms. Additionally, Red Hat Enterprise Linux Desktop 6.0, Server 6.0, and Workstation 6.0 are affected through their bundled Flash Player packages.
How do I fix CVE-2018-4878?
The most effective remediation is to completely uninstall Adobe Flash Player, as it reached end-of-life on December 31, 2020 and no longer receives security updates. Block Flash content at the network level and remove all Flash Player plugins from managed browsers.
How severe is CVE-2018-4878?
CVE-2018-4878 has a CVSS 3.1 score of 7.8 (HIGH) and an EPSS score of 93.3% (99.8th percentile), indicating near-certain exploitation. The vulnerability enables arbitrary code execution and is actively used in ransomware campaigns, making it a critical risk for any system still running Flash Player.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.