CVE-2018-15982High· 7.8▾ Abyssal⚠ Exploited in the wildPoC availableFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 17.9 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Aug 15, 2022
82%
82% → 90%
Last analysed / modified upstream
Exploit-DB · 7 GitHub repos (last check)
Added to the CISA catalog on Feb 15, 2022. Federal remediation due Aug 15, 2022. View catalog ↗
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
flash_player <= 31.0.0.153enterprise_linux_desktop = 6.0enterprise_linux_server = 6.0enterprise_linux_workstation = 6.0flash_player_installer <= 31.0.0.108Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2016-4117Critical· 9.8Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2022-26485High· 8.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free
CVE-2020-3992Critical· 9.8OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue
CVE-2021-34486High· 7.8Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2022-26486Critical· 9.6An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
CVE-2022-2586Medium· 5.3It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.