CVE-2018-4878

HIGH KEV RANSOMWARE

Adobe Flash Player < 28.0.0.161 - Use-After-Free in Primetime SDK Media Player Listener Handling

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-4878 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 16 public exploits from researchers including SyFi, smgorelik, qazbnm456.

AI-analyzed exploit summary This exploit leverages CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player, to achieve remote code execution (RCE) via a crafted SWF file. The payload includes shellcode generated by Msfvenom to execute calc.exe, demonstrating the vulnerability's exploitability.

Description

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Exploits (16)

exploitdb WORKING POC
by SyFi · pythonremotemultiple
https://www.exploit-db.com/exploits/44412

This exploit leverages CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player, to achieve remote code execution (RCE) via a crafted SWF file. The payload includes shellcode generated by Msfvenom to execute calc.exe, demonstrating the vulnerability's exploitability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.161)
No auth needed
Prerequisites: Victim must visit a malicious webpage hosting the exploit · Adobe Flash Player must be installed and vulnerable
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by smgorelik · textlocalwindows
https://www.exploit-db.com/exploits/44744

This exploit targets CVE-2018-4878, a vulnerability in Adobe Flash Player. It leverages a crafted Excel file to trigger a use-after-free condition, leading to remote code execution (RCE) by popping a calculator as a proof-of-concept.

Classification
Working Poc 80%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player ActiveX plugin 28.0.0.137
No auth needed
Prerequisites: Victim must have vulnerable Flash Player version installed · Victim must open the malicious Excel file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by smgorelik · textlocalwindows
https://www.exploit-db.com/exploits/44745

This exploit targets CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player. The provided SWF file triggers the vulnerability to achieve remote code execution, demonstrated by popping up a calculator.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player 28.0.0.137
No auth needed
Prerequisites: Victim must have Flash ActiveX 28.0.0.137 installed · Victim must open the malicious SWF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 3,480 stars
by qazbnm456 · poc
https://github.com/qazbnm456/awesome-cve-poc/tree/master/CVE-2018-4878.md

This repository provides a curated list of references and external resources related to CVE-2018-4878, a critical Adobe Flash Player vulnerability involving a use-after-free (UAF) bug. It includes links to technical analyses, malware samples, and advisory reports but does not contain direct exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Adobe Flash Player up to 28.0.0.137
No auth needed
Prerequisites: Victim must have vulnerable Adobe Flash Player installed · Attacker must deliver malicious SWF file to victim
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 87 stars
by vysecurity · client-side
https://github.com/vysecurity/CVE-2018-4878

This repository contains an Aggressor script for Cobalt Strike that exploits CVE-2018-4878, a vulnerability in Adobe Flash Player before February 2018. The exploit is designed to be hosted and delivered via Internet Explorer, resulting in a reverse shell within the IE sandbox.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions before February 2018)
No auth needed
Prerequisites: Cobalt Strike with Aggressor Script support · Victim using Internet Explorer with vulnerable Flash Player version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 23 stars
by mdsecactivebreach · client-side
https://github.com/mdsecactivebreach/CVE-2018-4878

This repository contains a proof-of-concept exploit for CVE-2018-4878, a critical Adobe Flash Player vulnerability. The exploit leverages a use-after-free bug to achieve remote code execution (RCE) via a malicious SWF file.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.161)
No auth needed
Prerequisites: Victim must have vulnerable Adobe Flash Player installed · Victim must visit a malicious webpage hosting the exploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 14 stars
by xbl3 · poc
https://github.com/xbl3/awesome-cve-poc_qazbnm456/tree/master/CVE-2018-4878.md

This repository provides a curated list of references and external resources related to CVE-2018-4878, a Flash Player UAF vulnerability. It includes links to PoC samples, technical analyses, and advisory reports but does not contain direct exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Adobe Flash Player up to 28.0.0.137
No auth needed
Prerequisites: victim interaction to load malicious Flash content
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 8 stars
by SyFi · client-side
https://github.com/SyFi/CVE-2018-4878

This is a Python-based proof-of-concept exploit for CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player. It delivers a shellcode payload (calc.exe) via a malicious SWF file served over HTTP, targeting Flash Player versions prior to the fix.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions before 28.0.0.137)
No auth needed
Prerequisites: Victim must visit a malicious URL hosting the exploit · Adobe Flash Player must be installed and vulnerable
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by B0fH · client-side
https://github.com/B0fH/CVE-2018-4878

This is a Metasploit module exploiting CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player. It leverages a DRM manager object reference issue to achieve remote code execution on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player <= 28.0.0.137
No auth needed
Prerequisites: Vulnerable Adobe Flash Player version · Target system running Windows 7/8.1 with IE or Firefox
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by HuanWoWeiLan · client-side
https://github.com/HuanWoWeiLan/SoftwareSystemSecurity-2019

This is a Python script that generates a malicious SWF file exploiting CVE-2018-4878, a critical Adobe Flash Player remote code execution vulnerability. The exploit embeds shellcode to spawn a reverse shell and uses a crafted RDF structure to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.137)
No auth needed
Prerequisites: Victim must open the malicious SWF file in a vulnerable Flash Player version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS 1 stars
by ydl555 · poc
https://github.com/ydl555/CVE-2018-4878-

The repository contains a README.md with minimal content in Chinese, mentioning server cluster CMS identification, backup finding, and injection, but lacks actual exploit code or technical details for CVE-2018-4878.

Classification
Suspicious 30%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
gitlab WORKING POC
by 0x1 · client-side
https://gitlab.com/0x1/CVE-2018-4878

This repository contains a functional exploit for CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player. The exploit uses a crafted SWF file delivered via an HTTP server to achieve remote code execution (RCE) by executing a calc.exe shellcode.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.161)
No auth needed
Prerequisites: Victim must visit a malicious webpage hosting the exploit · Adobe Flash Player must be installed and enabled
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by lvyoshino · client-side
https://github.com/lvyoshino/CVE-2018-4878

This is a Python-based exploit for CVE-2018-4878, a critical Adobe Flash Player remote code execution vulnerability. It leverages a crafted SWF file with embedded shellcode to achieve arbitrary code execution on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.161)
No auth needed
Prerequisites: Vulnerable Adobe Flash Player installation · User interaction to open malicious SWF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Yable · poc
https://github.com/Yable/CVE-2018-4878

This is a Python-based exploit for CVE-2018-4878, a critical Adobe Flash Player remote code execution vulnerability. It includes shellcode and constructs a malicious SWF file to trigger the vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions up to 28.0.0.137)
No auth needed
Prerequisites: Victim must have vulnerable Adobe Flash Player installed · Victim must open the malicious SWF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by KathodeN · client-side
https://github.com/KathodeN/CVE-2018-4878

This repository contains a Python script that generates an exploit for CVE-2018-4878, a vulnerability in Adobe Flash Player. The script embeds a Metasploit-generated shellcode (default payload is a Windows calculator) into a malicious SWF file.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions prior to 28.0.0.137)
No auth needed
Prerequisites: Victim must visit a malicious webpage hosting the exploit SWF file · Adobe Flash Player must be installed and vulnerable
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by demonsec666 · poc
https://github.com/demonsec666/CVE-2018-4878

This is an Aggressor Script for Cobalt Strike that weaponizes CVE-2018-4878, a Flash Player vulnerability, to deliver a payload via an Internet Explorer drive-by attack. The exploit targets outdated versions of Adobe Flash Player before February 2017.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flash Player (versions before February 2017)
No auth needed
Prerequisites: Cobalt Strike environment · Victim using Internet Explorer with vulnerable Flash Player
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (16)

Core 16
Core References
Technical Description, Third Party Advisory x_refsource_misc
http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0285
Broken Link vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040318
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102893
Third Party Advisory x_refsource_misc
https://github.com/vysec/CVE-2018-4878
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44412/

Scores

CVSS v3 7.8
EPSS 0.9351
EPSS Percentile 99.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2018-02-03
InTheWild.io 2018-02-06
ENISA EUVD EUVD-2018-16663
Ransomware Use Confirmed
CWE
CWE-416
Status published
Products (4)
adobe/flash_player < 28.0.0.161 (4 CPE variants)
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_server 6.0
redhat/enterprise_linux_workstation 6.0
Published Feb 06, 2018
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026