Double Free Vulnerability in Adobe Acrobat and Reader Products
CVE-2018-4990

8.8HIGH

Key Information:

Vendor: Adobe
Status: Adobe Acrobat And Reader 2018.011.20038 And Earlier, 2017.011.30079 And Earlier, And 2015.006.30417 And Earlier Versions
Vendor: CVE Published:; 9 July 2018

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 35%🦅 CISA Reported

What is CVE-2018-4990?

Adobe Acrobat and Reader prior to specified versions are vulnerable to a double free issue. This flaw could allow attackers to exploit the affected applications, potentially executing arbitrary code under the rights of the current user. Users should update to the latest versions to mitigate this risk.

CISA has reported CVE-2018-4990

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2018-4990 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2018-4990-poc
Created by dexteon