CVE-2018-4990: Adobe Acrobat and Reader Double Free Vulnerability

Description

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)35.9% · higher than 98% of CVEs

Exploited in the wildYes

CISA KEVListed Jun 8, 2022

Federal remediation dueJun 22, 2022

Ransomware campaign useNot known

Affected products

Which versions

AA

Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions ·

Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions · source: vendor

AD

Acrobat DC · Adobe

15.006.30060 through 15.006.30417; 15.008.20082 through 18.011.20038; 17.011.30059 through 17.011.30079 · source: NVD

AR

Acrobat Reader DC · Adobe

15.006.30060 through 15.006.30417; 15.008.20082 through 18.011.20038; 17.011.30059 through 17.011.30079 · source: NVD

AA

Acrobat and Reader · Adobe

All versions, or not specified · source: KEV