CVE-2013-0640

KEVAdobe Reader and Acrobat Memory Corruption Vulnerability

Description

An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedFeb 14, 2013

Last modifiedJun 16, 2026

Added to KEVMar 3, 2022

Remediation dueMar 24, 2022

References

blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.htmlBroken Link
blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.htmlBroken Link
lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.htmlMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0551.htmlThird Party Advisory
security.gentoo.org/glsa/glsa-201308-03.xmlThird Party Advisory
adobe.com/support/security/advisories/apsa13-02.htmlVendor Advisory
adobe.com/support/security/bulletins/apsb13-07.htmlBroken Link
kb.cert.org/vuls/id/422807Third Party AdvisoryUS Government Resource
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16406Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0640US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1678 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 86.9% · top 1% of all CVEs
Weakness: CWE-787

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.