CVE-2018-15982

HIGH7.8

CISA KEV

Published 2019-01-18 · Updated 2026-08-13 · Source psirt@adobe.com

Description

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-416CWE-416

CISA Known-Exploited Vulnerability

Product: Adobe — Flash Player

Name: Adobe Flash Player Use-After-Free Vulnerability

Date added: 2022-02-15 · Due: 2022-08-15

USED IN RANSOMWARE

Required action: The impacted product is end-of-life and should be disconnected if still in use.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-95862
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
2026-09-22 · score 7.5
CVE-2026-95861
A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.
2026-09-22 · score 7.5
CVE-2026-94462
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
2026-09-22 · score 7.1
CVE-2026-84395
Premiere Pro [NEEDS REVIEW: environment mismatch — product 'Premiere Pro' is only known to appear in the 'Bucket A' bucket but environment_type 'Desktop' is in the 'Bucket A' bucket. This changes the exploitation clause and/or ATO eligibility — verify before publishing.] is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
2026-09-22 · score 7.1
CVE-2026-83963
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
2026-09-22 · score 7.8