---
id: "CVE-2018-4878"
kind: "vulnerability"
aliases: ["CVE-2018-4878"]
title: "Adobe Flash Player: Adobe Flash Player Use-After-Free Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.89532
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Adobe Flash Player", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-flash-player", "browsers", "exploited", "macos", "ransomware", "runtime", "windows"]
not_affected_if: ["no-flash-installed"]
published_at: "2018-02-06T21:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-4878", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-4878", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4878", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Adobe Flash Player: Adobe Flash Player Use-After-Free Vulnerability

Adobe Flash Player has a use-after-free memory bug that lets an attacker run code on the victim's machine. CISA lists it as exploited in the wild and tied to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Flash Player affected ? fixed ?

## How to check

Check whether Adobe Flash Player is installed on any machine or browser profile, for example by looking for FlashPlayer plugin files or running the Flash version check in the browser.

## Fix

Remove Adobe Flash Player, since the product is end-of-life and no fixed version is available from the sources.
Disconnect any system that still needs Flash from the network until it is removed.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-4878
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-4878
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-4878

## From the sources

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_