8.8 High Exploited

CVE-2018-4990 Adobe Acrobat and Reader Double Free Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-415

Description

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Affected products and versions

Product	Affected versions	Fixed in
Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions	Versions not published

References

helpx.adobe.com helpx.adobe.com
1040920 www.securitytracker.com
104167 www.securityfocus.com

Timeline

Published July 9, 2018
Added to the KEV catalogue June 8, 2022
Last modified October 21, 2025

The 47 CVEs of Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions →

CVE-2018-4970 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier… Not rated CVE-2018-4986 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier… Not rated CVE-2018-4978 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier… Not rated CVE-2018-4950 Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier… Not rated

Track this CVE