Live › vulnerability › CVE-2018-4990
Go to dashboardAdobe Acrobat and Reader contain a double free memory bug that can be triggered to corrupt memory. An attacker who gets a victim to open a crafted PDF can run code on the victim's machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Acrobat and Reader | vendor | – | – |
| adobe acrobat dc | vendor | >= 15.006.30060, <= 15.006.30417 | – |
| adobe acrobat dc | vendor | >= 15.008.20082, <= 18.011.20038 | – |
| adobe acrobat dc | vendor | >= 17.011.30059, <= 17.011.30079 | – |
| adobe acrobat reader dc | vendor | >= 15.006.30060, <= 15.006.30417 | – |
| adobe acrobat reader dc | vendor | >= 15.008.20082, <= 18.011.20038 | – |
| adobe acrobat reader dc | vendor | >= 17.011.30059, <= 17.011.30079 | – |
Open Acrobat or Reader and check Help > About to see the installed version; compare it against the vendor's fixed build.
Apply the update from Adobe per vendor instructions (CISA KEV required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
This page as .md · .json · in your agent: get_signal("CVE-2018-4990")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.