AEGLIX vulnerability intelligence
CVE-2018-4990
HIGH · CVSS 8.8 · Analyzed
Published: 2018-07-09 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Severity and scoring
- CVSS score
- 8.8 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-415
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Adobe · Acrobat and Reader
- Added to catalog
- 2022-06-08
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-06-22
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*
From (inclusive): 15.006.30060
Through (inclusive): 15.006.30417
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
From (inclusive): 15.008.20082
Through (inclusive): 18.011.20038
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*
From (inclusive): 17.011.30059
Through (inclusive): 17.011.30079
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*
From (inclusive): 15.006.30060
Through (inclusive): 15.006.30417
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*
From (inclusive): 15.008.20082
Through (inclusive): 18.011.20038
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*
From (inclusive): 17.011.30059
Through (inclusive): 17.011.30079
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://www.securityfocus.com/bid/104167
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040920
Broken Link · Third Party Advisory · VDB Entry
- https://helpx.adobe.com/security/products/acrobat/apsb18-09.html
Vendor Advisory
- http://www.securityfocus.com/bid/104167
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040920
Broken Link · Third Party Advisory · VDB Entry
- https://helpx.adobe.com/security/products/acrobat/apsb18-09.html
Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4990
Third Party Advisory · US Government Resource