Vulnerability record · CVE-2018-16042 · published 18 January 2019
CVE-2018-16042: Adobe Acrobat and Reader signature verification bypass allows information disclosure
Adobe · Acrobat Dc
Adobe Acrobat and Reader contain a security bypass vulnerability rooted in improper verification of cryptographic signatures (CWE-347). A crafted PDF can defeat the digital signature validation, undermining the trust users place in signed documents. The flaw affects multiple Acrobat and Reader release branches, and Adobe has published a fix.
Description
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to information disclosure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Automated analysis
medium priorityCVSS 6.5 medium severity with no confirmed exploitation, but a very high EPSS score and a signature-bypass class that erodes document trust warrant prompt patching.
What it is
Adobe Acrobat and Reader contain a security bypass vulnerability rooted in improper verification of cryptographic signatures (CWE-347). A crafted PDF can defeat the digital signature validation, undermining the trust users place in signed documents. The flaw affects multiple Acrobat and Reader release branches, and Adobe has published a fix.
Impact
An attacker can make a tampered PDF appear validly signed, enabling information disclosure and integrity loss in the document workflow. The CVSS vector rates confidentiality and integrity impact as low, with no availability impact.
Attack surface
Reached over the network via a crafted PDF opened in Acrobat or Reader; the CVSS vector shows no privileges and no user interaction required, though in practice a victim must open or process the document.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.8243, 99.6th percentile), and references are vendor and third-party advisories rather than exploit code, so active exploitation is not confirmed by this record.
What to do
- Apply the Adobe security update referenced in APSB18-41 to all affected Acrobat and Reader versions.
- Upgrade to a release newer than the affected branches (2019.008.20081, 2017.011.30106, 2015.006.30457 and earlier).
- Treat signed PDFs from untrusted sources with caution until all endpoints are patched.
- Inventory Acrobat, Reader and bundled third-party PDF products (e.g. iSkysoft PDF Editor/PDFelement) to confirm coverage.
Detection
- Monitor for PDF files that fail or bypass signature validation in Acrobat/Reader logs or endpoint telemetry.
- Hunt for processes opening PDFs from email attachments or downloads shortly before unusual outbound traffic.
- Track version reporting for Acrobat and Reader to find hosts still on the affected builds.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/106159 | Third Party AdvisoryVDB Entry |
| https://helpx.adobe.com/security/products/acrobat/apsb18-41.html | PatchVendor Advisory |
| https://pdf-insecurity.org/signature/evaluation_2018.html | Third Party Advisory |
| https://pdf-insecurity.org/signature/signature.html | Third Party Advisory |
| https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/ | Third Party Advisory |
| http://www.securityfocus.com/bid/106159 | Third Party AdvisoryVDB Entry |
| https://helpx.adobe.com/security/products/acrobat/apsb18-41.html | PatchVendor Advisory |
| https://pdf-insecurity.org/signature/evaluation_2018.html | Third Party Advisory |
| https://pdf-insecurity.org/signature/signature.html | Third Party Advisory |
| https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/ | Third Party Advisory |
Track CVE-2018-16042 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-16042), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
