8.8High KEV

CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability

Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions Published: 2018-07-09 22:00 (8 years ago)

Known exploited — Adobe Acrobat and Reader Double Free Vulnerability

CISA confirmed this vulnerability is used in real attacks on 08.06.2022. Remediation deadline for US federal agencies: 22.06.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-4990

Description

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Weakness (CWE): CWE-415

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
adobe	acrobat dc	15.006.30060 – ≤ 15.006.30417
adobe	acrobat reader dc	15.006.30060 – ≤ 15.006.30417
—	Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions	Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions

References and patches

https://helpx.adobe.com/security/products/acrobat/apsb18-09.html Vendor Advisory
1040920 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
104167 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4990 Third Party AdvisoryUS Government Resource

CPE matches (NVD) (6)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30417
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 18.011.20038
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30079
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30417
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 18.011.20038
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30079

CVSS score

8.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	8.8High
nvd	CVSS 3.1	8.8High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8High
nvd	CVSS 2.0	6.8Medium

EPSS (chance of exploitation in 30 days)

35.94%

higher than 98% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2018-01-03
Published2018-07-09 22:00
Reached IP-DB2026-10-24 23:32
Added to KEV2022-06-08
Last updated2026-06-17 04:59

Assigned by (CNA): adobe
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Adobe Acrobat / Reader

8.8High

CVE-2026-100134 13 days ago

Acrobat for Edge | Out-of-bounds Write (CWE-787)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

4.3Medium

CVE-2026-100132 13 days ago

Acrobat for Edge | Out-of-bounds Read (CWE-125)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…

5.5Medium

CVE-2026-81984 1 month ago

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a vic…

7.8High

CVE-2026-81989 1 month ago

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

5.5Medium

CVE-2026-81991 1 month ago

Acrobat Reader | Out-of-bounds Read (CWE-125)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that …

7.8High

CVE-2026-81980 1 month ago

Acrobat Reader | Out-of-bounds Write (CWE-787)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.