CVE-2013-0641KEV · OVERDUE

Adobe Reader Buffer Overflow Vulnerability

High · published February 14, 2013

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
7.8
EPSS
32%
Percentile
98.3
In the wild
Confirmed
What it is

🔥 A crafty crafted PDF is all it takes for an attacker to execute arbitrary code on Adobe Reader before version 9.5.4 — it’s like a Trojan horse disguised as a harmless document! 🚨 Imagine receiving a beautifully wrapped gift that’s really full of sneaky surprises — this vulnerability lets attackers slip in their malicious code undetected, just waiting to be unwrapped when you least expect it. If exploited, this vulnerability could allow attackers to take control of your system, run any code they want, and access sensitive information. The implications are absolutely devastating, especially since it’s already being exploited in the wild!

Put simply

Imagine receiving a beautifully wrapped gift that’s really full of sneaky surprises — this vulnerability lets attackers slip in their malicious code undetected, just waiting to be unwrapped when you least expect it. This buffer overflow vulnerability occurs in Adobe Reader and Acrobat, enabling attackers to manipulate the memory allocation of the application, leading to remote code execution via maliciously crafted PDF documents.

What to do

If exploited, this vulnerability could allow attackers to take control of your system, run any code they want, and access sensitive information. The implications are absolutely devastating, especially since it’s already being exploited in the wild! To protect yourself, update Adobe Reader and Acrobat to the latest versions: 9.5.4, 10.1.6, or 11.0.02 and beyond. Ensure automatic updates are enabled to close this gap in protection quickly! You've got this! With these updates, you’ll be keeping those sneaky surprises at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.32346 · 98.3th percentile
Published
2013-02-14T01:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 14 FEB 01:00Z
    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via…
    cvelistv5