CVE-2018-4893

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.06.5Medium EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-02-27Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

n/a Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versionsAffected: Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and…Upgrade to: not statedStated by: CVE record
Adobe AcrobatAffected: ≥ 17.0, ≤ 17.011.30070Upgrade to: after 17.011.30070Stated by: NVD
Adobe Acrobat DcAffected: ≤ 18.009.20050Upgrade to: after 18.009.20050Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Adobe Acrobat Reader/Acrobat versions are installed on business computers (look at “About” in the app) and confirm whether you’re at or below 2018.009.20050, 2017.011.30070, or 2015.006.30394.
Update Adobe Acrobat/Acrobat Reader to a release that includes the fix from Adobe Security Bulletin APSB18-02 (the one referenced in the advisory).
Until updated, restrict opening files from untrusted sources (especially unexpected XPS files) and route those documents through a safer review process (e.g., only open after IT approval).

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of XPS font processing. A successful attack can lead to sensitive data exposure.

In plain language

Written by AI from the record

CVE-2018-4893 is a bug in older Adobe Acrobat Reader versions that can expose sensitive information when opening a specially crafted XPS file; most small businesses should update, but there’s no confirmed public exploitation.

CVE-2018-4893 is an out-of-bounds read (CWE-125) in Adobe Acrobat Reader’s XPS font processing that can disclose sensitive data when a user opens a maliciously crafted XPS document; no KEV listing or public exploit code was found.

If you're affected

Sensitive document data exposure
Leak of confidential business files
Increased breach and compliance risk

What is it

This is a weakness in older Adobe Acrobat Reader versions where opening a specially made “XPS” document can cause Acrobat to read beyond where it should. If that happens, parts of sensitive information could be exposed to the attacker. Think of it like a program mis-reading a page of a document and accidentally “peeking” at nearby private data.

Who is affected

This matters if your small business uses Adobe Acrobat or Adobe Acrobat Reader (especially older versions) to open documents, and users might receive XPS files from email or the web. It’s most relevant when the malicious content can be delivered in a document a person opens. Based on the findings, there’s no confirmed public exploit code and no KEV listing; risk is mainly tied to whether a crafted XPS file can be opened in your environment.

How urgent is it

This is a medium-severity issue, and there’s no confirmed public exploitation (no KEV listing and no public exploit code on record). Still, because it involves sensitive data exposure via document opening, you should patch it as part of your normal update cycle without delay.

What to do — in detail

Confirm exposure
- On each device where Adobe Acrobat Reader/Acrobat is installed, open the app and check “About” to record the installed version.
- Mark the machines as affected if the version is 2018.009.20050 or earlier, 2017.011.30070 or earlier, or 2015.006.30394 or earlier.
Find the fixed release
- Use Adobe Security Bulletin APSB18-02 (linked in the findings) to identify the specific patched Acrobat Reader/Acrobat version(s) and upgrade targets for your installed branch.
Upgrade / remediate
- Upgrade Acrobat Reader/Acrobat to the version(s) specified as fixed by APSB18-02.
- If you have managed deployment (SCCM/Intune/macOS management), update via your normal software distribution method and verify completion.
Temporary workaround (if patching is delayed)
- Block or tightly control opening of XPS files from untrusted sources.
- Treat unexpected XPS attachments as suspicious and have IT review them before users open them.
What to monitor after updating
- Confirm the updated version is actually running (not just the installer staged).
- If your organization logs document-related activity, watch for attempts to open XPS files from unusual sources and confirm they are not repeated.

Technical context

CVE-2018-4893 is caused by a buffer boundary error (CWE-125: out-of-bounds read) in Adobe Acrobat Reader’s XPS font processing. A maliciously crafted XPS document can trigger a computation that reads past the end of a buffer, which may result in sensitive data disclosure. The weakness is consistent with user interaction requirements (the user must open/trigger processing of the document).

Findings indicate: no KEV listing, no public exploit code on record, and no confirmed press attention. Exploit likelihood is predicted as rising, but that is not presented as confirmed exploitation. Remediation guidance is available via Adobe’s APSB18-02 security bulletin.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3130 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

adobecommercial · USaka adobe systems inc.
- acrobat readerDesktop AppOn-premConsumer Software / productivity
- acrobat reader dcDesktop AppOn-premConsumer Software / productivity

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact