CVE-2013-2729KEV · OVERDUE

Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

High · published May 16, 2013

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.

1649
days past CISA
deadline
CVSS v3.1
8.8
EPSS
67%
Percentile
99.3
In the wild
Confirmed
What it is

🔥 An integer overflow in Adobe Reader could let attackers slip in arbitrary code just like a magician pulling a rabbit out of a hat — and no one even sees it coming! Imagine a restaurant where the chef mistakenly thinks they have an endless supply of ingredients. They keep adding more to the pot without realizing they just overflowed the simmering soup all over the kitchen floor! That's how an integer overflow allows attackers to execute arbitrary code. An attacker could execute any code they desire on a vulnerable system, potentially allowing them to steal sensitive information, corrupt files, or even take control of the machine. This could lead to a catastrophic breach, leaving users vulnerable and their data at risk.

Put simply

Imagine a restaurant where the chef mistakenly thinks they have an endless supply of ingredients. They keep adding more to the pot without realizing they just overflowed the simmering soup all over the kitchen floor! That's how an integer overflow allows attackers to execute arbitrary code. CVE-2013-2729 describes an integer overflow vulnerability in Adobe Reader and Acrobat, versions before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03, which permits attackers to execute arbitrary code through unspecified vectors.

What to do

An attacker could execute any code they desire on a vulnerable system, potentially allowing them to steal sensitive information, corrupt files, or even take control of the machine. This could lead to a catastrophic breach, leaving users vulnerable and their data at risk. Immediately upgrade to Adobe Reader and Acrobat versions 9.5.5, 10.1.7, or 11.0.03 to mitigate this vulnerability. It's also wise to conduct a security audit to ensure no unauthorized access has occurred. Regular updates are your best defense against these sneaky exploits! You've got this! Stay ahead of the game, and patch those vulnerabilities to keep your digital fortress strong! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.66555 · 99.3th percentile
Published
2013-05-16T10:00Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 16 MAY 10:00Z
    Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via…
    cvelistv5