CVE-2018-5002

Adobe Flash Player's unpatched stack-based buffer overflow allowed remote code execution, proving that end-of-life software remains a perpetual liability.

Adobe Flash Player reached end-of-life in December 2020 without further patches, leaving all remaining installations perpetually vulnerable to exploits like CVE-2018-5002. DIB organizations must ensure no legacy software remains in production, as unpatched RCE vulnerabilities directly violate CMMC/NIST 800-171 requirements for patch management and system hardening. Immediate action requires inventorying and removing all discontinued software, replacing it with supported alternatives.

Shame score — Adobe continued shipping a product with known critical vulnerabilities long after its discontinuation, and the lack of patches for end-of-life software represents a negligent, avoidable failure that directly enables ransomware and data breaches.