CVE-2018-15982
HighExploitedPublic exploitFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
Published Jan 18, 2019 · Updated Oct 1, 2026 · Also known as UBUNTU-CVE-2018-15982
Key Facts
Patch immediately- CVE-2018-15982 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Flash Player (Adobe), Flash Player Installer (Adobe), Enterprise Linux Desktop (Redhat) and 4 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 29, 2018 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 90% probability of exploitation in the next 30 days.
- Fixed versions are available, including Flash Player <=31.0.0.153, Flash Player Installer <=31.0.0.108, flash-plugin 0:32.0.0.101-1.el6_10.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
90%
Higher than 99.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-15982 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Feb 15, 2022 | Aug 15, 2022 | Known |
| Industry KEV feed | Nov 29, 2018 | Aug 15, 2022 | Known |
| CIRCL KEV | Feb 15, 2022 | Aug 15, 2022 | Known |
| ENISA EUVD | Feb 15, 2022 | n/a | Not reported |
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Affected Products
12 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Flash PlayerAdobe | See advisory | 31.0.0.153 |
| Flash Player InstallerAdobe | See advisory | 31.0.0.108 |
| Enterprise Linux DesktopRedhat | 6.0 | n/a |
| Enterprise Linux ServerRedhat | 6.0 | n/a |
| Enterprise Linux WorkstationRedhat | 6.0 | n/a |
Patched Releases
Flash Player
<=31.0.0.153
Flash Player Installer
<=31.0.0.108
flash-plugin
0:32.0.0.101-1.el6_10
flashplugin-nonfree
32.0.0.101ubuntu0.14.04.1, 32.0.0.101ubuntu0.16.04.1, 32.0.0.101ubuntu0.18.04.1
Timeline
Added to Industry KEV feed
Nov 29, 2018
Publicly disclosed
Jan 18, 2019
Added to CISA KEV
Feb 15, 2022
Added to CIRCL KEV
Feb 15, 2022
Added to ENISA EUVD
Feb 15, 2022
Last updated
Oct 1, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryRHSA-2018:3795
- advisoryhttps://rhn.redhat.com/errata/RHSA-2018-3795.html
- advisoryhttps://ubuntu.com/security/CVE-2018-15982
- advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
- advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15982
FAQ
Common Questions.
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.
Affected: Flash Player (Adobe); Flash Player Installer (Adobe); Enterprise Linux Desktop (Redhat) versions 6.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 29, 2018 and is known to be used in ransomware campaigns.
Yes. It was added on Feb 15, 2022 with a federal remediation due date of Aug 15, 2022.
Public exploit code is available.
Fixed versions are available, including Flash Player <=31.0.0.153, Flash Player Installer <=31.0.0.108, flash-plugin 0:32.0.0.101-1.el6_10.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2018-15982 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo