PatchTheCVECVE-2018-4871: An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137
CVE-2018-4871 is a high-severity flaw (CVSS 7.5) affecting enterprise linux desktop, enterprise linux server, enterprise linux workstation. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Why this priority
- High severity
- EPSS top 7%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 5.5% (top 7%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2018-01-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-4871?
enterprise linux desktop: mitigate or apply the listed mitigation; enterprise linux server: mitigate or apply the listed mitigation; enterprise linux workstation: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-4871 being exploited?
CVE-2018-4871 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-4871 affect?
CVE-2018-4871 affects enterprise linux desktop, enterprise linux server, enterprise linux workstation. Severity is high (CVSS 7.5). An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer off
How urgent is CVE-2018-4871?
Priority 59/100. High severity; EPSS top 7%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2017-5436 HIGH 8.8 MITIGATE MITIGATE An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font
- CVE-2018-1061 MEDIUM 6.5 UPGRADE MITIGATE python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking
- CVE-2018-11784 MEDIUM 4.3 UPGRADE MITIGATE When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 re
- CVE-2016-6794 MEDIUM 5.3 UPGRADE MITIGATE When a SecurityManager is configured, a web application's ability to read system properties should be controll
- CVE-2016-10165 HIGH 7.1 UPGRADE MITIGATE The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive