CVE-2018-18688
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or annotations, Body Updates are displayed to the user without any action by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects LibreOffice, Master PDF Editor, Nitro Pro, Nitro Reader, Nuance Power PDF Standard, PDF Editor 6 Pro, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, Perfect PDF 10 Premium, and Perfect PDF Reader.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe PDF specification lacks guidance on validating signatures with incremental saves. Attackers can exploit the Incremental Saving feature to add pages or annotations that are displayed to users without the signature-validation logic detecting the modification, allowing visual deception while the signature appears valid.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 5.1.12= 5.1.68= 5.1.24= 9.4= 9.1.0= 9.2.0>= 9.0, < 9.4= 8.3.9= 11.0.3.173= 5.5.9.2= 6.4.2.3521= 6.6.2.3315= 6.7.6.3399= 6.8.0.3523= 6.8.4.3921= 6.7.1.3355= 6.7.6.3399= 6.0.6.2= 6.1.3.2= 6.1.0.3CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed PDF product and versionOpen the PDF application and navigate to Help > About, or check the program's file properties (right-click executable > Properties > Details) to find the exact version numberAffected if The installed version matches any of the affected versions listed for the product (e.g., Foxit Reader 9.4, 9.1.0, 9.2.0; LibreOffice 6.0.6.2, 6.1.3.2, 6.1.0.3; etc.)
-
Locate the PDF file to inspectIdentify the signed PDF document you want to verify. Note the file path and sizeAffected if You have a signed PDF file opened in or imported into an affected PDF product version
-
Examine PDF structure for incremental updatesOpen the PDF file in a hex editor or use a PDF parsing tool (such as pdfid, pdf-parser from Didier Stevens, or similar) to inspect the file structure. Look for multiple cross-reference tables (/xref) or multiple incremental update sections after the %%EOF markerAffected if The PDF contains more than one incremental save section, indicating the document was modified after the original signature was applied
-
Check for additional content after signatureUsing a PDF analysis tool, examine the incremental update sections to determine if new pages, annotations, or content were appended after the original /Sig or /ByteRange entryAffected if The signature's ByteRange covers only the original content, but additional content exists after the signed portion, meaning the visual display may differ from what the signature actually covers
-
Compare visual content to signature coverageParse the /Sig dictionary and its ByteRange value to identify exactly which byte ranges are included in the signature calculation. Then verify whether any visual elements displayed to you fall outside those rangesAffected if Visual content shown to you (new pages, annotations, modified text) falls outside the ByteRange covered by the digital signature
You are affected if you are using any of the listed product versions AND you open a signed PDF that contains incremental updates where content was added after the signature was applied, resulting in additional visual elements that the signature does not cover.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor data9.4
Upgrade affected PDF products to patched versions (Foxit Reader/PhantomPDF to 9.4+, etc.) and implement document integrity verification procedures that detect incremental changes beyond the original signed content.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,200.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2018-18688 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2018-18688 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data