CVE-2007-0046: Adobe Acrobat Reader Plugin double free via AJAX request parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 7.5 and high EPSS percentile indicate significant risk, though no active exploitation in KEV is reported.

What it is

The Adobe Acrobat Reader browser plugin before 8.0.0 contains a double free vulnerability triggered through the FDF, XML, or XFDF AJAX request parameters. A remote attacker can cause an error via a javascript: URI call to document.write, leading to memory corruption. This matters because it can result in arbitrary code execution in the context of the browser.

Impact

An attacker can execute arbitrary code on the victim's system, potentially leading to full compromise of the user's machine. The CVSS 2.0 vector indicates partial confidentiality, integrity, and availability impact.

Attack surface

The flaw is reachable remotely over the network without authentication, as indicated by the CVSS vector AV:N/AC:L/Au:N. User interaction is likely required to visit a malicious page or open a crafted document, but the record does not explicitly state this.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS probability is 0.55924 (99th percentile), indicating a high likelihood of exploitation. A reference is tagged with 'Exploit', suggesting public exploit code may exist.

What to do

• Update Adobe Acrobat Reader to version 8.0.0 or later.
• Apply vendor patches referenced in Adobe security bulletin APSB07-01.
• Disable the Adobe Acrobat Reader browser plugin if not required.
• Restrict the use of javascript: URIs in browsers where possible.
• Follow vendor advisories from Red Hat, SUSE, Gentoo, and Sun for patched packages.

Detection

• Monitor for unusual document.write calls or javascript: URI invocations in browser processes.
• Detect crashes or abnormal termination of the Adobe Acrobat Reader plugin.
• Look for network requests containing FDF, XML, or XFDF parameters from untrusted sources.
• Use endpoint detection to identify memory corruption patterns in Acrobat Reader processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.