CVE-2018-4890

Exploitation likely. EPSS gives it a 25% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.08.8High EPSS percentile98th25% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-02-27Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

n/a Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versionsAffected: Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and…Upgrade to: not statedStated by: CVE record
Adobe AcrobatAffected: ≥ 17.0, ≤ 17.011.30070Upgrade to: after 17.011.30070Stated by: NVD
Adobe Acrobat DcAffected: ≤ 18.009.20050Upgrade to: after 18.009.20050Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your installed Adobe version(s) for “Adobe Acrobat Reader” or “Adobe Acrobat DC”.
If your version is 2018.009.20050 or earlier, 2017.011.30070 or earlier, or 2015.006.30394 or earlier, you are at risk.
Update Adobe to a version fixed by Adobe’s advisory APSB18-02 (apply the update from the link below).
After updating, ensure users open emails/documents from unknown sources as little as possible, since the attack requires opening a crafted file.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a heap overflow vulnerability in the image conversion engine, when handling JPEG data embedded within an XPS file. A successful attack can lead to code corruption, control-flow hijack, or an information leak attack.

In plain language

Written by AI from the record

This is a vulnerability in older Adobe Acrobat Reader and Adobe Acrobat DC versions that could let an attacker take over your computer if you open a specially crafted file; a typical small business should update, especially if staff receive lots of PDFs or documents by email.

CVE-2018-4890 is a heap overflow in Adobe Acrobat Reader/Acrobat’s image conversion engine triggered by JPEG data embedded in an XPS file, where opening a malicious document can lead to memory corruption (potential code execution, data exposure, and crashes).

If you're affected

Possible malware execution
Customer/document data exposure
Computer disruption from crashes
Ransomware risk via takeover

What is it

Think of Adobe Acrobat as software that “reformats” images when it opens documents. This flaw happens when it processes certain image data inside a file type (XPS) that includes JPEG content. A malicious file could cause the program to crash or, in worse cases, allow harmful control of your computer.

Who is affected

This matters if your business uses Adobe Acrobat Reader or Adobe Acrobat DC on computers where staff may open documents from email, the web, or file shares. The risk is mainly when an attacker can get a specially crafted XPS file to you and you open it. It’s not a silent background flaw—it's triggered by opening a malicious file.

How urgent is it

This is AMBER because the vulnerability is capable of serious outcomes (memory corruption) and involves common document-opening behavior. There is no confirmed public exploit code on record and it’s not listed in CISA’s KEV set, but the likelihood is rising and the potential impact is high. Prioritize updating Adobe on any machines that handle incoming documents.

What to do — in detail

Confirm affected software and current versions
- On each workstation/server running Adobe Acrobat Reader or Adobe Acrobat DC, check the application’s version number.
- Compare against the affected ranges:
  - Adobe Acrobat Reader 2018.009.20050 and earlier
  - Adobe Acrobat Reader 2017.011.30070 and earlier
  - Adobe Acrobat Reader 2015.006.30394 and earlier
- If any machine matches these ranges, treat it as vulnerable.
Upgrade to the fixed version
- Use Adobe’s remediation guidance for APSB18-02 from the provided advisory link.
- If you manage updates centrally, roll out the approved Adobe update to all affected endpoints.
If you cannot patch immediately (temporary containment)
- Reduce exposure to unexpected files: tighten controls on downloading/opening XPS files, especially those received via email attachments.
- Train users not to open unexpected document attachments and to route suspicious files to an approval process.
Validate after patching
- Re-check the installed Acrobat/Reader version numbers to confirm they are no longer within the affected “and earlier” ranges.
What to monitor
- If available in your environment, review endpoint security logs for unexpected Acrobat crashes or suspicious behavior around the times users open documents.
- Continue watching for any new advisories or exploit reports related to CVE-2018-4890.

Technical context

Severity is HIGH (CVSS 8.8). The weakness is CWE-787 (heap overflow). The attack trigger is processing of JPEG data embedded within an XPS file by Adobe’s image conversion engine; opening the malicious document can result in memory corruption, which may lead to control-flow hijacking, information leakage, or application crashes.

KEV (CISA Known Exploited Vulnerabilities): not listed. Exploitation evidence: no public exploit code is on record. Predicted likelihood (EPSS): 24.5% with a rising trend (prediction only; not treated as confirmed exploitation). This CVE is therefore handled as a high-impact but not yet confirmed widely weaponized issue—consistent with the AMBER urgency level.

Note on reachability: the user interaction requirement is opening a crafted file; the attacker still needs a way to deliver such an XPS file to the victim.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

25% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3130 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

adobecommercial · USaka adobe systems inc.
- acrobat readerDesktop AppOn-premConsumer Software / productivity
- acrobat reader dcDesktop AppOn-premConsumer Software / productivity

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable