CVE-2018-4905

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.06.5Medium EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-02-27Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

n/a Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versionsAffected: Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and…Upgrade to: not statedStated by: CVE record
Adobe AcrobatAffected: ≥ 17.0, ≤ 17.011.30070Upgrade to: after 17.011.30070Stated by: NVD
Adobe Acrobat DcAffected: ≤ 18.009.20050Upgrade to: after 18.009.20050Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check the Adobe Acrobat version installed on employee computers and identify systems at or below the affected versions.
Install the Adobe security update from the vendor; the supplied findings do not state an exact fixed version, so use the release identified by Adobe’s bulletin for your update track.
Until updated, warn staff not to open unexpected document attachments or downloads.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of TIFF processing within the XPS module. A successful attack can lead to sensitive data exposure.

In plain language

Written by AI from the record

Adobe Acrobat versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, or 2015.006.30394 and earlier can expose private information when someone opens a booby-trapped document, so affected businesses should update.

Out-of-bounds read (CWE-125) in TIFF processing within the XPS module allows unauthenticated remote disclosure of sensitive memory after user interaction with a crafted document.

If you're affected

Private information exposure
Customer data exposure
Sensitive document disclosure
Employee privacy risk

What is it

A specially made document can make Adobe Acrobat reveal information that should stay inside the computer. It is like a filing cabinet drawer that opens slightly too far, letting a visitor glimpse papers from the next drawer.

Who is affected

This matters if your business uses Adobe Acrobat to open or process documents. It is only a risk if someone opens a crafted document.

How urgent is it

This is green because it is not listed as actively exploited by CISA and no public exploit code is on record. Schedule the vendor update through your normal maintenance process, while reminding staff to treat unexpected documents cautiously.

What to do — in detail

Confirm exposure by inventorying Adobe Acrobat installations and comparing their version numbers with the affected versions in the advisory. The supplied findings do not identify fixed versions for each release branch; use Adobe’s bulletin to select the correct current supported update for each installed track and test it through the normal software-deployment process. If patching is delayed, reduce exposure by blocking or quarantining unexpected document attachments and downloads before users open them. No CISA KEV due date applies because this CVE is not listed in KEV. Monitor endpoint or email-security alerts for suspicious documents and investigate any user reports of unusual files.

Technical context

CVSS v3.0 is 6.5 (Medium): AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The issue is CWE-125, an out-of-bounds read during processing of specific file formats; the technical description identifies TIFF processing in the XPS module. It is remotely deliverable, requires no authentication, and requires user interaction with a crafted document; the affected functionality is reachable in the default configuration. EPSS is 11.2% (96th percentile) and rising, which is a prediction rather than evidence of exploitation. The CVE is not in CISA KEV, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3130 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

adobecommercial · USaka adobe systems inc.
- acrobat readerDesktop AppOn-premConsumer Software / productivity
- acrobat reader dcDesktop AppOn-premConsumer Software / productivity

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact