CVE Watch1 de out. de 2026

CVE-2018-15982

Adobe Flash Player Use-After-Free Vulnerability

CVSS

7.8

Alta

EPSS

89.6%

p100

KEV

SIM

15 de fev. de 2022

Exploit Today

0-100

Publicado: 18 de jan. de 2019 · Última mod.: 1 de out. de 2026 · CWE-416

EPSS · 30d

89.6%EPSS · 30 dias89.6%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Adobe / Flash Player

Vulnerabilidade

Adobe Flash Player Use-After-Free Vulnerability

Adicionado ao KEV

15 de fev. de 2022

Corrigir até

15 de ago. de 2022

Uso conhecido em ransomware

Sim

Descrição resumida

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

Ação necessária

The impacted product is end-of-life and should be disconnected if still in use.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2018-15982

Descrição técnica

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-69044—

3.4%

——1In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.21h CVE-2026-69043—

3.4%

——1In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption21h CVE-2026-824189.8 CRÍ

38.6%

——12IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.1d CVE-2026-1219635.9 MÉD

23.8%

——7FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.5h CVE-2026-1219557.5 ALT

36.2%

——11FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.5h CVE-2026-1219539.8 CRÍ

46.5%

——14FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.5h