Actively exploited · Published May 16, 2013 · Assigned by adobe

CVE-2013-2729

High 8.8 Exploited

In plain English

A high-severity integer overflow in Reader and Acrobat from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 66.6% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)66.6%top 0.7% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

http://www.adobe.com/support/security/bulletins/apsb13-15.html x_refsource_CONFIRM
SUSE-SU-2013:0809 vendor-advisory, x_refsource_SUSE
RHSA-2013:0826 vendor-advisory, x_refsource_REDHAT
oval:org.mitre.oval:def:16717 vdb-entry, signature, x_refsource_OVAL
GLSA-201308-03 vendor-advisory, x_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2729 government-resource
https://github.com/cisagov/vulnrichment/issues/199 issue-tracking