CVE-2011-0592: Adobe Reader and Acrobat U3D decompression buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with a 9.3 CVSS score and very high EPSS, though no confirmed in-the-wild exploitation is documented in this record.

What it is

Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X contain a buffer overflow during decompression of a crafted Universal 3D (U3D) file, related to "Texture bmp." The flaw is a distinct issue from several other U3D vulnerabilities patched in the same cycle, and successful exploitation allows arbitrary code execution.

Impact

An attacker gains arbitrary code execution in the context of the user running Adobe Reader or Acrobat, which can lead to full compromise of the host.

Attack surface

The vulnerability is reached remotely by getting a victim to open a crafted U3D file, typically delivered via a web page or email attachment; no authentication is required, but user interaction to open the file is needed.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.476 (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Update Adobe Reader and Acrobat to 10.0.1, 9.4.2, or 8.2.6 (or later) per Adobe APSB11-03.
• Where immediate patching is not possible, disable or restrict U3D/3D content rendering in Reader and Acrobat.
• Block or strip U3D content in email attachments and web downloads at the gateway.
• Apply the Red Hat errata RHSA-2011-0301 where the affected Adobe packages are deployed on Red Hat systems.

Detection

• Monitor for Reader/Acrobat processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Inspect for U3D files with anomalous "Texture bmp" structures or unusually large decompressed sizes.
• Alert on crashes or buffer-overflow indicators in AcroRd32.exe or Acrobat.exe when opening PDFs with embedded 3D content.
• Review endpoint logs for suspicious file writes or network callbacks originating from Reader/Acrobat after opening documents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.