CVE-2018-4898 in the critical feed json
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 an…
published 2018-02-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-16683
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.1%
- EPSS 15.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the XPS engine that adds vector graphics and images to a fixed page. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Exploit prediction
15.05% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- n/a Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
helpx.adobe.com
/security/products/acrobat/apsb18-02.html
vendor-advisory
-
securitytracker.com
/id/1040364
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/102994
vdb-entry, third-party-advisory
-
zerodayinitiative.com
/advisories/ZDI-18-208/
third-party-advisory
Sources
- CVE List CVE-2018-4898
- NVD CVE-2018-4898
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.