CVE Vulnerability Advisory Database

[Affected Scope] Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier

[Impact] Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

[Mitigation] Immediately apply the official Adobe security update (APSB26-43) and restrict opening untrusted PDF documents

[Affected Scope] Adobe Acrobat and Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier), and 20.005.30514 (and earlier)

[Impact] Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

[Mitigation] Immediately apply the official security patches provided by Adobe and restrict opening untrusted PDF documents

[Affected Scope] Adobe Acrobat and Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier), and 20.005.30418 (and earlier)

[Impact] Successful exploitation could lead to arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF

[Mitigation] Immediately apply the official Adobe security patches to upgrade to the latest secure versions

[Affected Scope] Adobe Acrobat Reader DC and Acrobat versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier), and 2017.011.30194 (and earlier)

[Impact] Unauthenticated attackers can execute arbitrary code in the context of the current user by tricking a victim into opening a crafted malicious PDF file

[Mitigation] Immediately apply the official Adobe security patches (APSB21-29) and upgrade to the latest secure versions

[Affected Scope] Adobe Acrobat and Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code in the context of the current user by tricking them into opening a crafted PDF

[Mitigation] Immediately apply the official Adobe security updates (APSB21-09) to upgrade to the latest secure versions

[Affected Scope] Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier

[Impact] Successful exploitation of this Use-After-Free vulnerability allows remote attackers to execute arbitrary code in the context of the current user by tricking them into opening a specially crafted PDF file

[Mitigation] Immediately apply the official Adobe security patch (APSB20-48) and restrict opening PDF files from untrusted sources

[Affected Scope] Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier

[Impact] Successful exploitation allows remote attackers to execute arbitrary code within the context of the current user session

[Mitigation] Immediately apply the official Adobe security updates (APSB18-09) to patch the vulnerability

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows operating systems.

[Impact] Attackers can bypass the sandbox protection mechanism and execute arbitrary native code in a privileged context.

[Mitigation] Immediately upgrade affected installations to patched versions 10.1.11, 11.0.08, or later.

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X

[Impact] Successful exploitation allows remote attackers to execute arbitrary code and gain full control of the target system via crafted PDF files

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to version 10.1.9, 11.0.06, or later to mitigate the vulnerability

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code with the privileges of the logged-in user and compromise the host system via a specially crafted PDF document

[Mitigation] Immediately update affected installations to patched versions (9.5.5, 10.1.7, 11.0.03 or later) or migrate to the latest Adobe Acrobat Reader DC

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02

[Impact] Remote attackers can bypass sandbox protections and execute arbitrary code on the target system via a specially crafted PDF document.

[Mitigation] Immediately update affected installations to the official patched versions (9.5.4, 10.1.6, 11.0.02 or later).

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) via a specially crafted PDF document

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to the latest patched versions (9.5.4, 10.1.6, 11.0.02 or higher)

[Affected Scope] Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a specially crafted PDF document containing malicious U3D data

[Mitigation] Apply the official security patches immediately, or disable the vulnerable U3D parsing component (rt3d.dll) as a temporary workaround

[Affected Scope] Adobe Flash Player before 10.2.154.27, Adobe Reader/Acrobat 9.x and 10.x, and Microsoft Office documents containing embedded Flash (.swf) files.

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (DoS) via crafted Flash content embedded in documents or web pages.

[Mitigation] Immediately uninstall legacy Adobe Flash Player, update Adobe Reader/Acrobat to the patched versions, and restrict Flash execution in Office documents.

[Affected Scope] Adobe Flash Player 10.2.154.13 and earlier (Windows, macOS, Linux, Solaris), Flash Player for Android 10.1.106.16 and earlier, Adobe AIR 2.5.1 and earlier, and Authplay component in Adobe Reader/Acrobat 9.x through 9.4.2 and 10.x through 10.0.1

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) by tricking users into opening crafted Flash content (.swf), often embedded in Excel spreadsheets or malicious web pages

[Mitigation] Immediately upgrade affected Adobe products to patched versions, or completely uninstall/disable Flash Player and the Authplay.dll component on legacy systems

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document containing a long field in a SING table of a TTF font

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to patched versions (9.4 / 8.2.5 or later) and restrict opening untrusted PDF attachments

[Affected Scope] Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader/Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X

[Impact] Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content

[Mitigation] Immediately upgrade all affected Adobe products to the latest patched versions, or disable/rename the vulnerable authplay.dll component

[Affected Scope] Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1

[Impact] Remote Code Execution (RCE) or Denial of Service (DoS) via specially crafted PDF documents

[Mitigation] Apply official Adobe security patches immediately and restrict opening untrusted PDF files

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2, and 7.x before 7.1.4 on Windows and Mac OS X

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document containing malformed U3D data

[Mitigation] Apply the official vendor security patches immediately, or disable 3D/U3D rendering features via registry policies