CVE-2018-4888 Use after free in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions
A use-after-free flaw in the XFA engine allows arbitrary code execution via a crafted PDF file in Adobe Acrobat Reader.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-4888?
CVE-2018-4888 is a high-severity use after free vulnerability in Adobe Acrobat, published on 27 Feb 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability. The vulnerability is triggered by a crafted PDF file that can cause a memory access violation exception in the XFA engine because of a dangling reference left as a consequence of freeing an object in the computation that manipulates internal nodes in a graph representation of a document object model used in XFA. Successful exploitation could lead to arbitrary code execution.
Weakness: CWE-416
Which versions are affected by CVE-2018-4888?
It affects 4 products.
Products include Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader, Adobe Acrobat Reader Dc.
How do I fix CVE-2018-4888?
No fix has been published for CVE-2018-4888 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-4888 being exploited?
There is no known exploitation of CVE-2018-4888 in the wild and no public exploit code.
Other vulnerabilities in Adobe Acrobat
Sources
Also known as GHSA-cmw5-5438-frv3.