8.8Hoch KEV

CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability

Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions Veröffentlicht: 2018-07-09 22:00 (vor 8 Jahren)

Bekannt ausgenutzt — Adobe Acrobat and Reader Double Free Vulnerability

CISA hat am 08.06.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 22.06.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-4990

Beschreibung

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Schwachstellentyp (CWE): CWE-415

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
adobe	acrobat dc	15.006.30060 – ≤ 15.006.30417
adobe	acrobat reader dc	15.006.30060 – ≤ 15.006.30417
—	Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions	Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions

Referenzen und Patches

https://helpx.adobe.com/security/products/acrobat/apsb18-09.html Vendor Advisory
1040920 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
104167 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4990 Third Party AdvisoryUS Government Resource

CPE-Treffer (NVD) (6)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30417
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 18.011.20038
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30079
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30417
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 18.011.20038
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30079

CVSS-Score

8.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	8.8Hoch
nvd	CVSS 3.1	8.8Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8Hoch
nvd	CVSS 2.0	6.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

35.94%

höher als 98 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2018-01-03
Veröffentlicht2018-07-09 22:00
Bei IP-DB eingegangen2026-10-24 23:32
In KEV aufgenommen2022-06-08
Zuletzt aktualisiert2026-06-17 04:59

Vergeben von (CNA): adobe
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Adobe Acrobat / Reader

8.8Hoch

CVE-2026-100134 vor 14 Tagen

Acrobat for Edge | Out-of-bounds Write (CWE-787)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

4.3Mittel

CVE-2026-100132 vor 14 Tagen

Acrobat for Edge | Out-of-bounds Read (CWE-125)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…

5.5Mittel

CVE-2026-81984 vor 1 Monat

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a vic…

7.8Hoch

CVE-2026-81989 vor 1 Monat

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

5.5Mittel

CVE-2026-81991 vor 1 Monat

Acrobat Reader | Out-of-bounds Read (CWE-125)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that …

7.8Hoch

CVE-2026-81980 vor 1 Monat

Acrobat Reader | Out-of-bounds Write (CWE-787)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.