Loading vulnerability…
CVE-2018-4878 is a use-after-free vulnerability in Adobe Flash Player affecting versions before 28.0.0.161, including 28.0.0.137 and earlier. The flaw is caused by a dangling pointer in the Primetime SDK related to media player handling of listener objects; reporting also identifies the vulnerable code path as involving the DRMManager initialize call. By triggering the stale object reference after the underlying object has been freed, an attacker can corrupt memory and gain control of execution flow. Successful exploitation allows arbitrary code execution in the context of the user running Flash content. The vulnerability was exploited in the wild as a zero-day in targeted attacks and was commonly delivered through malicious Microsoft Office documents containing embedded Flash content.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a proof-of-concept exploit for CVE-2018-4878, a critical use-after-free vulnerability in Adobe Flash Player. The main file, Flashp0c.py, is a Python script that generates a malicious SWF file containing Windows shellcode (calc.exe) and an HTML file that embeds the SWF. The script then starts a local HTTP server on port 8080, serving these files to potential victims. When a vulnerable browser loads the index.html page, the embedded SWF triggers the vulnerability, resulting in execution of the shellcode (calc.exe) on the victim's Windows system. The exploit is operational, with a hardcoded payload, and is intended for demonstration and research purposes. The README provides context and credits, referencing the original PoC and the author's modifications.
This repository is a proof-of-concept (POC) exploit for CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player (version 27, 32-bit). The exploit is implemented as a malicious SWF file, with supporting ActionScript 3 source code in the 'src' directory. The main exploit logic is in 'Main.as', which triggers the vulnerability by manipulating DRM event listeners and ByteArray objects, resulting in a corrupted ByteArray with arbitrary memory read/write capabilities. The 'bin/index.html' file is used to load the SWF in a browser environment, leveraging 'swfobject.js' for embedding. The exploit does not include a weaponized payload but demonstrates the ability to gain memory access, which can be used for further exploitation. The repository is structured for research and demonstration purposes, with clear separation between source, build, and deployment files. No hardcoded network endpoints or external C2 infrastructure are present; the attack is delivered via a browser loading the malicious SWF.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Adobe Flash Player vulnerability reportedly possibly exploited in campaigns associated with Egregor delivery.
An Adobe Flash Player vulnerability reportedly possibly exploited in campaigns associated with Egregor, according to the content.
Adobe Flash Player zero-day vulnerability used by the Geumseong121 group in targeted attacks, including delivery via KakaoTalk.
A use-after-free vulnerability in Adobe Flash Player used by the Underminer exploit kit.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.