CVE-2013-0640: Adobe Reader and Acrobat memory corruption via crafted PDF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is listed in CISA KEV with confirmed in-the-wild exploitation, has a very high EPSS score, and allows remote code execution through a common file type.

What it is

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 contain an out-of-bounds write (CWE-787) that memory corruption can be triggered by a crafted PDF document. The flaw was exploited in the wild in February 2013, so it is a real, weaponized client-side issue rather than a theoretical one. It matters because PDFs are routinely opened by users and the affected products were widely deployed.

Impact

An attacker can execute arbitrary code in the context of the user running Reader or Acrobat, or cause a denial of service through memory corruption. Successful code execution gives the attacker the user's privileges on the workstation.

Attack surface

Reached by getting a victim to open a malicious PDF in Adobe Reader or Acrobat; the CVSS vector is local with user interaction required (AV:L/AC:L/PR:N/UI:R), meaning no authentication is needed but the user must open the file. No network service exposure is described.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-03, and the description states it was exploited in the wild in February 2013; EPSS is 0.86979 (99.7th percentile), indicating high predicted exploitation activity. No ransomware campaign use is documented.

What to do

• Apply the vendor updates that resolve this issue: Adobe Reader/Acrobat 9.5.4, 10.1.6, and 11.0.02 or later, per Adobe advisory APSA13-02/APSB13-07.
• Apply the Linux distribution errata for affected openSUSE, SUSE, and Red Hat packages (for example RHSA-2013-0551 and the referenced openSUSE advisories).
• If immediate patching is not possible, disable or restrict JavaScript in Adobe Reader/Acrobat and avoid opening untrusted PDFs.
• Enforce CISA KEV required action by the 2022-03-24 due date for any remaining affected systems.

Detection

• Hunt for Adobe Reader/Acrobat processes spawning child processes such as cmd.exe, powershell.exe, or scripting interpreters, which is abnormal for PDF viewing.
• Monitor for PDF files written to temp or download directories that are immediately opened by Reader/Acrobat, especially from email or web download sources.
• Check endpoint and vulnerability inventory for Reader/Acrobat versions below 9.5.4, 10.1.6, or 11.0.02 and for unpatched Linux packages covered by the referenced advisories.
• Review proxy and email gateway logs for PDF attachments or downloads matching known exploit indicators from the referenced FireEye and CERT reporting.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.