Log in Start free

Actively exploited · Published Dec 7, 2011 · Assigned by adobe

CVE-2011-2462

High 8.8 Exploited

In plain English

A high-severity out-of-bounds write in Reader and Acrobat from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 88.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)88.6%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 22, 2022.

Official description

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References