CVE-2018-4913

HIGH

Adobe Acrobat/Reader <17.011.30070/<18.009.20050/<15.006.30394 XFA Engine Use-After-Free

Title source: llm

Description

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the XFA engine, related to DOM manipulation. The vulnerability is triggered by crafted XFA script definitions in a PDF file. Successful exploitation could lead to arbitrary code execution.

References (4)

Core 4

Core References

Third Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-18-176/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102995

Vendor Advisory x_refsource_confirm

https://helpx.adobe.com/security/products/acrobat/apsb18-02.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040364

Scores

CVSS v3 8.8

EPSS 0.1402

EPSS Percentile 96.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (6)

adobe/acrobat 17.0 - 17.011.30070

adobe/acrobat_dc - - 18.009.20050

adobe/acrobat_dc 15.0 - 15.006.30394

adobe/acrobat_reader 17.0 - 17.011.30070

adobe/acrobat_reader_dc - - 18.009.20050

adobe/acrobat_reader_dc 15.0 - 15.006.30394

Published Feb 27, 2018

Tracked Since Feb 18, 2026