CVE-2018-4990

high-risk

Published 2018-07-09

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Do I need to act?

51.5% chance of exploitation in next 30 days

EPSS score — higher than 48% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (4)

Acrobat Dc

Acrobat Reader Dc

Affected Vendors

Adobe

References (7)

Broken Link http://www.securityfocus.com/bid/104167

Broken Link http://www.securitytracker.com/id/1040920

Vendor Advisory https://helpx.adobe.com/security/products/acrobat/apsb18-09.html

Broken Link http://www.securityfocus.com/bid/104167

Broken Link http://www.securitytracker.com/id/1040920

Vendor Advisory https://helpx.adobe.com/security/products/acrobat/apsb18-09.html

Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-...

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 25/34 · High

Exposure 10/34 · Low