Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-4879: Adobe Acrobat Reader can be tricked into running code

CVE-2018-4879 · published 8 years ago

Summary

Certain older versions of Adobe Acrobat and Acrobat Reader may let specially crafted image files cause the program to write outside its intended memory area. This could let an attacker corrupt data or run their own code on a user’s computer. Upgrade to the latest Adobe Acrobat/Reader version or apply available patches to remove the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	acrobat	>= 17.0, <= 17.011.30070 `cpe:2.3:a:adobe:acrobat::::::::`
adobe	acrobat_dc	>= -, <= 18.009.20050 >= 15.0, <= 15.006.30394 `cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*`
adobe	acrobat_reader	>= 17.0, <= 17.011.30070 `cpe:2.3:a:adobe:acrobat_reader::::::::`
adobe	acrobat_reader_dc	>= -, <= 18.009.20050 >= 15.0, <= 15.006.30394 `cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*`

Original advisory text

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that processes Enhanced Metafile Format Plus (EMF+) data. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.

References

http://www.securityfocus.com/bid/102994 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040364 Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb18-02.html Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

29% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published27 Feb 2018

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2018-4879 · NVD

Track software like this

Free during beta