Adobe · Reader
CVE-2013-0641
Adobe Reader Buffer Overflow Vulnerability
Exploited in attacks
High 7.8 Attack chance: 32%
What it is
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
CISA: A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 24, 2022
- Added to the CISA list
- March 3, 2022
- Published
- February 14, 2013
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 32% in the top 1.7% of all known vulnerabilities
- Weakness
- CWE-120
- More details
- NVD · CVE.org · CISA
All references (12)
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.html
- http://rhn.redhat.com/errata/RHSA-2013-0551.html
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.html
- http://security.gentoo.org/glsa/glsa-201308-03.xml
- http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html
- http://www.kb.cert.org/vuls/id/422807
- http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html
- http://www.adobe.com/support/security/bulletins/apsb13-07.html
- http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16296
- http://www.adobe.com/support/security/advisories/apsa13-02.html
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | – |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Use-After-Free | Acrobat | High 7.8 | 33% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 24, 2025 | Improper Input Validation | Commerce and Magento | Critical 9.1 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.