VulnerabilityModified

CVE-2018-4910

This vulnerability is an instance of a heap overflow vulnerability in the JavaScript engine.

HIGH 8.8EPSS 24.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 24.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a heap overflow vulnerability in the JavaScript engine. The vulnerability is triggered by a PDF file with crafted JavaScript code that manipulates the optional content group (OCG). A successful attack can lead to code corruption, control-flow hijack, or a code re-use attack.

CVSS 3.0: 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 24.53% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: adobe/acrobat · adobe/acrobat dc · adobe/acrobat reader · adobe/acrobat reader dc
Source: psirt@adobe.com

References

http://www.securityfocus.com/bid/102992Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040364Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb18-02.htmlVendor Advisory
http://www.securityfocus.com/bid/102992Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040364Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb18-02.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.