CVE-2018-4990
Adobe Acrobat and Reader Double Free Vulnerability
Description
CVE-2018-4990 is a double free vulnerability in Adobe Acrobat and Reader that allows remote code execution when a user opens a specially crafted PDF document. The flaw occurs when the application frees the same memory allocation twice, corrupting heap management structures and enabling an attacker to execute arbitrary code with the privileges of the current user. Successful exploitation of this Adobe Acrobat vulnerability can lead to complete system compromise through malicious PDF files delivered via email or web downloads. CISA has added CVE-2018-4990 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 62.0% (98th percentile), this vulnerability requires urgent remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat dc | >= 15.006.30060, <= 15.006.30417; >= 15.008.20082, <= 18.011.20038; >= 17.011.30059, <= 17.011.30079 |
| adobe | acrobat reader dc | >= 15.006.30060, <= 15.006.30417; >= 15.008.20082, <= 18.011.20038; >= 17.011.30059, <= 17.011.30079 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/104167(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040920(Broken Link, Third Party Advisory, VDB Entry)
- https://helpx.adobe.com/security/products/acrobat/apsb18-09.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4990(Third Party Advisory, US Government Resource)
Weakness Type
CWE-415: Double Free
CVE-2018-4990 exploits a double free vulnerability in Adobe Acrobat and Reader, where the application calls free() on the same memory address twice during PDF document processing. The second free operation corrupts the heap allocator's metadata structures, and subsequent memory allocations can return the same memory region to different parts of the application, enabling an attacker to manipulate heap state and achieve arbitrary code execution.
Learn more: CWE-415 — Double Free
Impact Analysis
CVE-2018-4990 is a high-severity vulnerability in Adobe Acrobat and Reader that is remotely exploitable through a crafted PDF document, making it particularly dangerous in enterprise environments where PDF files are routinely exchanged. The attack requires only that a user opens the malicious PDF — no additional interaction is needed. Confidentiality and integrity are critically impacted as the double free enables arbitrary code execution with the privileges of the user running Adobe Acrobat or Reader, allowing an attacker to access files, steal credentials, install malware, or pivot to other systems. Availability can also be affected through denial of service or destructive payloads. The EPSS score of 62.0% (98th percentile) indicates very high exploitation probability, reflecting the attractiveness of PDF-based exploit vectors for both targeted and broad-scale attacks. Given that Adobe Acrobat and Reader are installed on hundreds of millions of systems worldwide, the potential impact is enormous.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-4990 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 22, 2022. The EPSS score of 62.0% (98th percentile) reflects very high exploitation probability. No specific ransomware campaigns have been publicly attributed to this vulnerability alone, but PDF-based exploit vectors are frequently used in targeted spear-phishing campaigns and have been observed in conjunction with other exploits for privilege escalation. The double free vulnerability class in document readers is well-understood by exploit developers, making reliable exploitation achievable.
Remediation
- Update Adobe Acrobat and Reader immediately to the latest patched version as directed by the CISA KEV catalog. Install the Adobe security update that addresses CVE-2018-4990.
- Enable Protected View and sandboxed reading mode in Adobe Acrobat and Reader, which restricts the actions that can be performed when opening documents from untrusted sources.
- Deploy email gateway security with PDF inspection capabilities to detect and quarantine malicious PDF documents before they reach end users, including sandboxing attachments for dynamic analysis.
- Restrict JavaScript execution in PDF reader by disabling JavaScript in Adobe Acrobat/Reader preferences (Edit > Preferences > JavaScript > uncheck "Enable Acrobat JavaScript"), as many PDF exploits rely on JavaScript for heap manipulation.
- Implement endpoint detection and response (EDR) with rules to detect anomalous child process creation from Adobe Acrobat/Reader processes, which is a common indicator of successful PDF exploitation.
Technical Details
CVE-2018-4990 is a double free vulnerability in Adobe Acrobat and Reader triggered during the processing of specially crafted PDF documents. The vulnerability occurs when a specific code path in the PDF parsing engine frees a heap-allocated memory buffer and subsequently frees the same buffer again through a separate code path, typically in an error handling or cleanup routine. The second free() call corrupts the heap allocator's free list metadata, creating a condition where subsequent heap allocations return memory that overlaps with already-allocated objects. An attacker exploits this by using JavaScript within the PDF to perform heap spraying and careful object placement (heap feng shui), ensuring that attacker-controlled data occupies the corrupted memory region. When the application subsequently uses the corrupted object, its overwritten function pointers or vtable entries redirect execution to shellcode placed by the attacker.
Frequently Asked Questions
Is CVE-2018-4990 being actively exploited?
Yes. CISA has added CVE-2018-4990 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 62.0% (98th percentile) indicates very high exploitation probability. PDF-based exploits leveraging this vulnerability have been used in targeted attack campaigns.
What products are affected by CVE-2018-4990?
CVE-2018-4990 affects Adobe Acrobat and Adobe Reader across multiple versions. Both the free Reader and the commercial Acrobat product are vulnerable. Consult the Adobe Security Bulletin for specific version numbers and platform details.
How do I fix CVE-2018-4990?
Update Adobe Acrobat and Reader to the latest patched versions. Enable Protected View and disable JavaScript in PDF reader settings for additional protection. Deploy email gateway filtering to catch malicious PDFs before delivery.
How severe is CVE-2018-4990?
CVE-2018-4990 is a high-severity double free vulnerability with an EPSS score of 62.0% in the 98th percentile. It enables remote code execution through a malicious PDF document, requiring only that a user opens the file. The ubiquity of Adobe Acrobat/Reader and the common use of PDFs as an attack vector make this a high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.