Adobe Flash Player Stack-Based Buffer Overflow Remote Code Execution Vulnerability (CVE-2018-5002)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2018-5002) is a critical stack-based buffer overflow (CWE-121/CWE-787) residing in Adobe Flash Player. The root cause lies in the improper validation of input data length when parsing specially crafted SWF files. When Flash Player copies bytecode or media streams into a fixed-size stack buffer without adequate boundary checks, it overflows the stack memory, allowing adjacent memory structures, including the function return address, to be overwritten.

2. Exploitation Mechanics & Attack Scenario

In active exploitation scenarios, threat actors deliver the exploit by embedding malicious SWF objects into Microsoft Office documents (such as Word or Excel) or hosting them on compromised websites. When a victim opens the document or visits the webpage, the Flash Player engine automatically parses the embedded content, triggering the stack-based buffer overflow. The attacker carefully crafts the payload to hijack the execution flow (Instruction Pointer) and redirect it to shellcode, achieving remote code execution (RCE) without requiring administrative privileges.

3. Infrastructure & Business Impact

This vulnerability is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in targeted zero-day campaigns. Successful exploitation grants the attacker the ability to execute arbitrary commands under the security context of the logged-in user. If the compromised user has administrative privileges, the attacker can gain full control of the endpoint, facilitate lateral movement within the corporate network, exfiltrate sensitive data, or deploy ransomware.