CVE-2013-0641

KEVAdobe Reader Buffer Overflow Vulnerability

Description

A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedFeb 14, 2013

Last modifiedJun 16, 2026

Added to KEVMar 3, 2022

Remediation dueMar 24, 2022

References

blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.htmlBroken Link
blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.htmlBroken LinkVendor Advisory
blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploitBroken Link
lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.htmlMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0551.htmlThird Party Advisory
security.gentoo.org/glsa/glsa-201308-03.xmlThird Party Advisory
adobe.com/support/security/advisories/apsa13-02.htmlVendor Advisory
adobe.com/support/security/bulletins/apsb13-07.htmlBroken Link
kb.cert.org/vuls/id/422807Third Party AdvisoryUS Government Resource
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16296Broken Link

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1677 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 32.3% · top 2% of all CVEs
Weakness: CWE-120

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.