PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-4990 Adobe CVE debrief

CVE-2018-4990 is an Adobe Acrobat and Reader double free vulnerability that CISA lists in the Known Exploited Vulnerabilities catalog. For defenders, the key point is that this issue was treated as actively exploited and required prompt patching per vendor guidance.

Vendor
Adobe
Product
Acrobat and Reader
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-06-08
Original CVE updated
2022-06-08
Advisory published
2022-06-08
Advisory updated
2022-06-08

Who should care

Security teams, endpoint administrators, and users responsible for Adobe Acrobat or Adobe Reader deployments should prioritize this CVE, especially where patch compliance is centrally managed.

Technical summary

The issue is described as a double free vulnerability in Adobe Acrobat and Reader. CISA’s KEV entry marks it as known exploited and directs defenders to apply updates per vendor instructions. No CVSS score was included in the supplied corpus.

Defensive priority

High. KEV inclusion means the vulnerability is known to be exploited in the wild, so remediation should be prioritized over routine patch backlogs.

Recommended defensive actions

  • Apply the vendor-recommended update for Adobe Acrobat and Reader as soon as possible.
  • Confirm the affected Adobe products are inventoried across endpoints and remote users.
  • Verify patch deployment and remove or quarantine unsupported versions if any remain.
  • Use the CISA KEV due date (2022-06-22) as the minimum remediation target for this item.
  • Monitor for failed updates and re-scan endpoints until compliance is confirmed.

Evidence notes

The supplied source corpus is the CISA Known Exploited Vulnerabilities JSON entry for CVE-2018-4990, which lists Adobe Acrobat and Reader, dateAdded 2022-06-08, dueDate 2022-06-22, and the required action 'Apply updates per vendor instructions.' The corpus also references the NVD detail page, but no CVSS score was provided in the structured input.

Official resources

CISA added CVE-2018-4990 to the Known Exploited Vulnerabilities catalog on 2022-06-08 and set a remediation due date of 2022-06-22. The supplied corpus does not include a CVSS score or additional vendor advisory details.