CVE-2018-5002
KEVAdobe Flash Player Stack-based Buffer Overflow Vulnerability
Description
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedJul 9, 2018
Last modifiedJun 17, 2026
Added to KEVMay 23, 2022
Remediation dueJun 13, 2022
References
- securityfocus.com/bid/104412Broken LinkThird Party Advisory
- securitytracker.com/id/1041058Broken LinkThird Party Advisory
- access.redhat.com/errata/RHSA-2018:1827Third Party Advisory
- helpx.adobe.com/security/products/flash-player/apsb18-19.htmlPatchVendor Advisory
- security.gentoo.org/glsa/201806-02Third Party Advisory
- github.com/cisagov/vulnrichment/issues/196Issue Tracking
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5002Third Party AdvisoryUS Government Resource
0 recent articles mention this CVE
72
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1596 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 25.1% · top 2% of all CVEs
- Weakness
- CWE-787
Recommended actions
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.