CVE-2007-5659KEV · OVERDUE

Adobe Acrobat and Reader Buffer Overflow Vulnerability

High · published February 12, 2008

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1583
days past CISA
deadline
CVSS v3.1
7.8
EPSS
87%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 Multiple buffer overflows in Adobe Reader and Acrobat from 2007 mean attackers can slip in malicious code just by sending a crafty PDF! ⚡ Think of this as a restaurant that lets anyone bring in their own dish without checking for allergens — you never know what’s going to be on the plate! 🍽️ An attacker can exploit this vulnerability to execute arbitrary code on the victim's machine, potentially giving them full control over the system. This could lead to data breaches, installation of malware, or even total system compromise — absolutely devastating!

Put simply

Think of this as a restaurant that lets anyone bring in their own dish without checking for allergens — you never know what’s going to be on the plate! 🍽️ This vulnerability allows remote attackers to trigger buffer overflows by sending specially crafted PDF files with overly long arguments in JavaScript methods, leading to arbitrary code execution.

What to do

An attacker can exploit this vulnerability to execute arbitrary code on the victim's machine, potentially giving them full control over the system. This could lead to data breaches, installation of malware, or even total system compromise — absolutely devastating! Update to the latest version of Adobe Reader and Acrobat immediately to close this security gap. Additionally, encourage users to avoid opening unknown PDFs, and consider disabling JavaScript in PDF settings for an extra layer of safety. 🛡️ You've got this! By taking these steps, you'll make your systems much safer from these sneaky attacks! 👍

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.87423 · 99.8th percentile
Published
2008-02-12T18:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 12 FEB 18:00Z
    Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to…
    cvelistv5