Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• adobe acrobat9.0 and later · before 9.5.4
• adobe acrobat10.0 and later · before 10.1.6
• adobe acrobat11.0 and later · before 11.0.02
• adobe acrobat reader10.0 and later · before 10.1.6
• adobe acrobat reader11.0 and later · before 11.0.02
• adobe acrobat reader9.0 and later · before 9.5.4
• opensuse opensuse11.4
• opensuse opensuse12.1
• redhat enterprise linux desktop6.0
• redhat enterprise linux eus5.9
• redhat enterprise linux eus6.4
• redhat enterprise linux server6.0
• redhat enterprise linux server aus5.9
• redhat enterprise linux server aus6.4
• redhat enterprise linux workstation6.0
• suse linux enterprise desktop10
• suse linux enterprise desktop11

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2011-2462Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x KEV
  96Now
• CVE-2013-3346Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a KEV
  93Now
• CVE-2021-21017Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionKEV
  91Now
• CVE-2009-3459Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exeKEV
  91Now
• CVE-2008-2992Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file tKEV
  91Now
• CVE-2009-3953The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remotKEV
  90Now

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.