CVE-2011-0593: Adobe Reader and Acrobat U3D decompression buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with full impact and a very high EPSS score, but exploitation requires the victim to open a crafted file and no KEV listing or confirmed in-the-wild activity is recorded.

What it is

Adobe Reader and Acrobat versions 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X contain a buffer overflow during decompression of a crafted Universal 3D (U3D) file. The flaw is improper input validation (CWE-20) and is distinct from several related U3D issues patched in the same bulletin. Successful exploitation allows arbitrary code execution in the context of the user opening the file.

Impact

An attacker gains arbitrary code execution with the privileges of the user running Adobe Reader or Acrobat. Because the CVSS 2.0 vector is AV:N/AC:M/Au:N/C:C/I:C/A:C (score 9.3), full confidentiality, integrity, and availability impact is possible without prior authentication.

Attack surface

Reached remotely by delivering a malicious U3D-containing PDF or file that the victim opens in the affected Reader or Acrobat build; no authentication is required, but user interaction (opening the file) is needed per the AV:N/AC:M vector. The record does not specify whether browser plug-in rendering alone is sufficient.

Exploitation

CISA KEV does not list this CVE, and no ransomware group usage is documented. EPSS is high (0.4954 probability, 98.8th percentile), and references include a Zero Day Initiative advisory (ZDI-11-069), indicating coordinated disclosure of a working exploit path, though the record does not state public exploit availability.

What to do

• Upgrade Adobe Reader and Acrobat to 10.0.1, 9.4.2, or 8.2.6 (or later) per Adobe bulletin APSB11-03.
• Apply the Red Hat errata RHSA-2011-0301 where the affected Adobe packages are shipped on managed Linux systems.
• Disable or restrict JavaScript and 3D/U3D content handling in Reader/Acrobat where the business does not require it.
• Block or sandbox untrusted PDF attachments at the mail and web gateway, and enforce Protected View/Enhanced Security settings.
• Retire or isolate end-of-life Reader/Acrobat 8.x and 9.x installations that cannot be patched.

Detection

• Hunt for Reader/Acrobat processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe, which is abnormal for normal PDF viewing.
• Monitor for PDF files containing U3D streams or unusual 3D annotation objects delivered via email or web download, and alert on their execution.
• Use the OVAL definition oval:org.mitre.oval:def:12258 to scan endpoints for vulnerable Reader/Acrobat versions.
• Review crash telemetry from Reader/Acrobat for repeated decompression-related faults that may indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.