PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-4990 Adobe CVE debrief

CVE-2018-4990 is an Adobe Acrobat and Reader double free vulnerability that CISA lists in the Known Exploited Vulnerabilities catalog. For defenders, the key point is that this issue was treated as actively exploited and required prompt patching per vendor guidance.

Vendor
Adobe
Product
Acrobat and Reader
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-06-08
Original CVE updated
2022-06-08
Advisory published
2022-06-08
Advisory updated
2022-06-08

Who should care

Security teams, endpoint administrators, and users responsible for Adobe Acrobat or Adobe Reader deployments should prioritize this CVE, especially where patch compliance is centrally managed.

Technical summary

The issue is described as a double free vulnerability in Adobe Acrobat and Reader. CISA’s KEV entry marks it as known exploited and directs defenders to apply updates per vendor instructions. No CVSS score was included in the supplied corpus.

Defensive priority

High. KEV inclusion means the vulnerability is known to be exploited in the wild, so remediation should be prioritized over routine patch backlogs.

Recommended defensive actions

  • Apply the vendor-recommended update for Adobe Acrobat and Reader as soon as possible.
  • Confirm the affected Adobe products are inventoried across endpoints and remote users.
  • Verify patch deployment and remove or quarantine unsupported versions if any remain.
  • Use the CISA KEV due date (2022-06-22) as the minimum remediation target for this item.
  • Monitor for failed updates and re-scan endpoints until compliance is confirmed.

Evidence notes

The supplied source corpus is the CISA Known Exploited Vulnerabilities JSON entry for CVE-2018-4990, which lists Adobe Acrobat and Reader, dateAdded 2022-06-08, dueDate 2022-06-22, and the required action 'Apply updates per vendor instructions.' The corpus also references the NVD detail page, but no CVSS score was provided in the structured input.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-4990 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-4990

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-4990 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-4990

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.