CVE-2018-4990
Adobe Acrobat and Reader Double Free Vulnerability
Published Jul 9, 2018 · updated Jun 16, 2026 · adobe acrobat dc
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Timeline
Detection, updates, and resolution for this record.
Jul 9, 2018 · Catalog
Detected
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Required action
Apply updates per vendor instructions.
CISA due date Jun 22, 2022
Affected
- cpe adobe/acrobat dcversion unspecified
- cpe adobe/acrobat reader dcversion unspecified
- vendor Adobe Acrobat and Readerversion unspecified
Sources
- CISA KEVCVE-2018-4990
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
cisa.gov - CVE.orgCVE-2018-4990
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-4990
30-day exploitation probability 36.2%
first.org - NIST NVDCVE-2018-4990
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
nvd.nist.gov