CVE-2018-5002

Adobe Flash Player 29.0.0.171 and earlier versions

Published 9 Jul 2018 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 23 May 2022, with a remediation deadline of 13 Jun 2022 for US federal agencies.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

References

www.securityfocus.com/bid/104412 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1041058 · Broken Link, Third Party Advisory, VDB Entry
access.redhat.com/errata/RHSA-2018:1827 · Third Party Advisory
helpx.adobe.com/security/products/flash-player/apsb18-19.html · Patch, Vendor Advisory
security.gentoo.org/glsa/201806-02 · Third Party Advisory
github.com/cisagov/vulnrichment/issues/196 · Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5002 · Third Party Advisory, US Government Resource