CVE-2018-4917 in the critical feed json
Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable he…
published 2018-05-19 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-16702
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.2%
- EPSS 17.2% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Patch / fix
- adobe acrobat_2017 17.011.30078
- adobe acrobat_dc 15.006.30413, 18.011.20035
- adobe acrobat_reader_2017 17.011.30078
- adobe acrobat_reader_dc 15.006.30413, 18.011.20035
Exploit prediction
17.19% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a Adobe Acrobat and Reader 2018.009.20050 and earlier versions , 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
helpx.adobe.com
/security/products/acrobat/apsb18-02.html
vendor-advisory
-
securityfocus.com
/bid/102992
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1040364
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-4917
- NVD CVE-2018-4917
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.