CVE-2010-2883
KEVAdobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
Description
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HPublishedSep 9, 2010
Last modifiedJun 16, 2026
Added to KEVJun 8, 2022
Remediation dueJun 22, 2022
References
- blog.metasploit.com/2010/09/return-of-unpublished-adobe.htmlBroken Link
- community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspxBroken Link
- lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.htmlBroken Link
- lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.htmlBroken Link
- secunia.com/advisories/41340Broken LinkVendor Advisory
- secunia.com/advisories/43025Broken LinkVendor Advisory
- security.gentoo.org/glsa/glsa-201101-08.xmlThird Party Advisory
- adobe.com/support/security/advisories/apsa10-02.htmlVendor Advisory
- adobe.com/support/security/bulletins/apsb10-21.htmlVendor Advisory
- kb.cert.org/vuls/id/491991Third Party AdvisoryUS Government Resource
- redhat.com/support/errata/RHSA-2010-0743.htmlBroken Link
- securityfocus.com/bid/43057Broken LinkThird Party Advisory
0 recent articles mention this CVE
75
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1588 days
- CVSS
- 7.3 HIGH
- EPSS (30-day exploit probability)
- 81.4% · top 1% of all CVEs
- Weakness
- CWE-787
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.