7.8High KEV

CVE-2018-5002Adobe Flash Player Stack-based Buffer Overflow Vulnerability

Adobe Flash Player 29.0.0.171 and earlier versions Published: 2018-07-09 22:00 (8 years ago)

Known exploited — Adobe Flash Player Stack-based Buffer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 23.05.2022. Remediation deadline for US federal agencies: 13.06.2022.

Required action: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2018-5002

Description

Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Weakness (CWE): CWE-121 CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
adobe	flash player	≤ 29.0.0.171
adobe	flash player desktop runtime	≤ 29.0.0.171
redhat	enterprise linux desktop	6.0
redhat	enterprise linux server	6.0
redhat	enterprise linux workstation	6.0
—	Adobe Flash Player 29.0.0.171 and earlier versions	Adobe Flash Player 29.0.0.171 and earlier versions

References and patches

RHSA-2018:1827 vendor-advisoryThird Party Advisory
1041058 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb18-19.html PatchVendor Advisory
GLSA-201806-02 vendor-advisoryThird Party Advisory
104412 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5002 Third Party AdvisoryUS Government Resource

CPE matches (NVD) (7)

cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* ≤ 29.0.0.171
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≤ 29.0.0.171
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* ≤ 29.0.0.171
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:* ≤ 29.0.0.171
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

CVSS score

7.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	7.8High
nvd	CVSS 3.1	7.8High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8High
nvd	CVSS 2.0	10.0High

EPSS (chance of exploitation in 30 days)

24.44%

higher than 98% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2018-01-03
Published2018-07-09 22:00
Reached IP-DB2026-10-24 23:33
Added to KEV2022-05-23
Last updated2026-06-17 04:59

Assigned by (CNA): adobe
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 yesterday

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 yesterday

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 yesterday

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 2 days ago

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 2 days ago

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 3 days ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…