CVE-2018-4990highunder attackCWE-415

CVE-2018-4990: high-severity vulnerability in Adobe Acrobat and Reader 2018.011.20038 and…

Published · Updated

Follow this CVE+ Monitor Adobe Acrobat+ Monitor Reader

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 36%
from disclosure to weapon
Published on NVDJul 9
CISA KEV+1430d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

Adobe Acrobat and Reader have a flaw where memory is freed twice, allowing attackers to run malicious code with user permissions. This puts your computer at risk if you open a specially crafted PDF file.

Technical detail

Double Free vulnerability in Adobe Acrobat/Reader allows an attacker to craft a malicious PDF that triggers improper memory deallocation, leading to heap corruption and arbitrary code execution in the user's security context. Exploitation requires user interaction to open the malicious document.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions