Loading vulnerability…
CVE-2018-4878 is a use-after-free vulnerability in Adobe Flash Player versions before 28.0.0.161. A dangling pointer in the Primetime SDK's handling of media-player listener objects permits arbitrary code execution. The vulnerability is also identified in the DRMManager initialize call in Flash Player 28.0.0.137 and earlier. Exploitation occurred through malicious Office documents containing embedded Flash objects and through browser exploit kits. It was exploited in the wild in January and February 2018, with APT37 exploitation reported as early as September 3, 2017.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository contains a proof-of-concept exploit for CVE-2018-4878, a critical use-after-free vulnerability in Adobe Flash Player. The main file, Flashp0c.py, is a Python script that generates a malicious SWF file containing Windows shellcode (calc.exe) and an HTML file that embeds the SWF. The script then starts a local HTTP server on port 8080, serving these files to potential victims. When a vulnerable browser loads the index.html page, the embedded SWF triggers the vulnerability, resulting in execution of the shellcode (calc.exe) on the victim's Windows system. The exploit is operational, with a hardcoded payload, and is intended for demonstration and research purposes. The README provides context and credits, referencing the original PoC and the author's modifications.
This repository is a proof-of-concept (POC) exploit for CVE-2018-4878, a use-after-free vulnerability in Adobe Flash Player (version 27, 32-bit). The exploit is implemented as a malicious SWF file, with supporting ActionScript 3 source code in the 'src' directory. The main exploit logic is in 'Main.as', which triggers the vulnerability by manipulating DRM event listeners and ByteArray objects, resulting in a corrupted ByteArray with arbitrary memory read/write capabilities. The 'bin/index.html' file is used to load the SWF in a browser environment, leveraging 'swfobject.js' for embedding. The exploit does not include a weaponized payload but demonstrates the ability to gain memory access, which can be used for further exploitation. The repository is structured for research and demonstration purposes, with clear separation between source, build, and deployment files. No hardcoded network endpoints or external C2 infrastructure are present; the attack is delivered via a browser loading the malicious SWF.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in Adobe Flash Player's Primetime SDK, caused by a dangling pointer during media-player listener-object handling. It affects versions before 28.0.0.161 and permits arbitrary code execution. Exploitation was observed in January and February 2018.
Identified as a vulnerability recently exploited by Group123. The content provides no vulnerability-specific technical details, affected products, or remediation information.
An Adobe Flash Player vulnerability reportedly possibly exploited in campaigns associated with Egregor delivery.
An Adobe Flash Player vulnerability reportedly possibly exploited in campaigns associated with Egregor, according to the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.