CVE-2011-0591: Adobe Reader and Acrobat U3D decompression buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with no authentication and high EPSS, but exploitation requires user interaction and the affected software is legacy.

What it is

Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X contain a buffer overflow during decompression of crafted Universal 3D (U3D) files, related to Texture and rgba handling. Successful exploitation allows remote code execution in the context of the user opening the document.

Impact

An attacker can execute arbitrary code with the privileges of the user running Adobe Reader or Acrobat. This can lead to full system compromise, data theft, or further lateral movement.

Attack surface

The flaw is reached by opening a malicious PDF containing a crafted U3D stream; no authentication is required, but user interaction (opening the file) is needed. The CVSS vector AV:N/AC:M/Au:N indicates network delivery with medium complexity and no authentication.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.47599 (98.79th percentile), indicating a high likelihood of exploitation activity. No public exploit references are tagged in the supplied data.

What to do

• Apply the Adobe security bulletin APSB11-03 update to upgrade Reader and Acrobat to 10.0.1, 9.4.2, or 8.2.6 or later.
• Disable or restrict the opening of U3D content in Adobe Reader and Acrobat via the Trust Manager or registry settings where possible.
• Enforce email and web gateway filtering to block PDFs with embedded U3D streams from untrusted sources.
• Run Adobe Reader and Acrobat with least privilege and enable Protected Mode/Enhanced Security where available.
• Monitor vendor advisories and apply subsequent cumulative patches for Reader and Acrobat.

Detection

• Search for PDF files containing U3D streams (e.g., /Subtype /U3D or /3D) in email attachments and web downloads.
• Monitor for Adobe Reader or Acrobat processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Use endpoint detection to flag crashes or buffer overflow indicators in AcroRd32.exe or Acrobat.exe when processing PDFs.
• Review proxy and email logs for PDFs from external sources that match known exploit delivery patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.