CVE-2018-5002 is a stack-based buffer overflow vulnerability in Adobe Flash Player versions 29.0.0.171 and earlier, impacting various products from Adobe, Apple, Google, Linux, Microsoft, and Red Hat. With a CVSS score of 7.8 (HIGH), successful exploitation could lead to arbitrary code execution with high impact on confidentiality, integrity, and availability, requiring user interaction. This vulnerability is actively exploited in the wild, as confirmed by its presence in the KEV catalog and recent discussions about the CHAINSHOT malware, despite no public exploit code being available on platforms like Metasploit or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 29.0.0.171CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* | ||
<= 29.0.0.171CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* | ||
<= 29.0.0.171CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:* | ||
<= 29.0.0.171CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.