Double free in Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and…
Priority CRITICAL 97Exploited in the wildCWE-415Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.
Summary
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Why it matters now
Exploitation Active In CISA KEV since 2022-06-08CISA due date 2022-06-22
EPSS 0.3594 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions | Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions | — | No fix listed | CNA |
- Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions Vendor— Affected Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | 15.006.30060 – 15.006.30417 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | 15.008.20082 – 18.011.20038 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | 17.011.30059 – 17.011.30079 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* | 15.006.30060 – 15.006.30417 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* | 15.008.20082 – 18.011.20038 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* | 17.011.30059 – 17.011.30079 | Vulnerable | Adobe |
| cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | all versions | Running on | Apple |
| cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
- cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* Versions 15.006.30060 – 15.006.30417 Vulnerable ·Adobe
- cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* Versions 15.008.20082 – 18.011.20038 Vulnerable ·Adobe
- cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* Versions 17.011.30059 – 17.011.30079 Vulnerable ·Adobe
- cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* Versions 15.006.30060 – 15.006.30417 Vulnerable ·Adobe
- cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* Versions 15.008.20082 – 18.011.20038 Vulnerable ·Adobe
- cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* Versions 17.011.30059 – 17.011.30079 Vulnerable ·Adobe
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions all versions Running on ·Apple
- cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-06-08 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-4990
- 2026-10-03 Alias added: GHSA-8x43-549v-7wcw
References
More Adobe Acrobat Dc vulnerabilities
- TI-2021-09626 Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution KEVCVSS 3.1HIGH 8.8
- TI-2021-04123 Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution KEVCVSS 3.1HIGH 8.8
- TI-2026-26867 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) KEVCVSS 3.1HIGH 8.6
- TI-2023-11518 [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild KEVCVSS 3.1HIGH 7.8
- TI-2023-07999 Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2020-07801 Use after free in Adobe Acrobat and Reader KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2018-4990 · CVE Program
- CVE-2018-4990 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-8x43-549v-7wcw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences