What’s Vulnerable › Vulnerabilities

CVE-2018-4917

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-19 · updated 2026-06-17
• Weakness: CWE-787

Description

Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Affected products

• Adobe Acrobat 2017: from 17.011.30070 before 17.011.30078 — fixed in 17.011.30078
• Adobe Acrobat DC: from 15.006.30394 before 15.006.30413; from 18.009.20050 before 18.011.20035 — fixed in 15.006.30413, 18.011.20035
• Adobe Acrobat Reader 2017: from 17.011.30070 before 17.011.30078 — fixed in 17.011.30078
• Adobe Acrobat Reader: from 15.006.30394 before 15.006.30413; from 18.009.20050 before 18.011.20035 — fixed in 15.006.30413, 18.011.20035

How to fix

Upgrade to a fixed version: Adobe Acrobat 2017 17.011.30078; Adobe Acrobat DC 15.006.30413, 18.011.20035; Adobe Acrobat Reader 2017 17.011.30078; Adobe Acrobat Reader 15.006.30413, 18.011.20035. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/102992
• http://www.securitytracker.com/id/1040364
• https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
• http://www.securityfocus.com/bid/102992
• http://www.securitytracker.com/id/1040364
• https://helpx.adobe.com/security/products/acrobat/apsb18-02.html

Get alerted when CVE-2018-4917 or the next vulnerability affects your stack