CVE-2013-0641: Adobe Reader and Acrobat PDF buffer overflow enabling code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with confirmed in-the-wild exploitation, has a high EPSS score, and allows remote code execution, though it requires user interaction and affects legacy software versions.

What it is

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 contain a classic buffer overflow (CWE-120) that can be triggered by a crafted PDF document. The flaw was exploited in the wild in February 2013, and successful exploitation allows arbitrary code execution in the context of the user opening the file.

Impact

An attacker who gets a victim to open a malicious PDF can execute arbitrary code with the privileges of the affected Reader or Acrobat process. This can lead to full compromise of the user's session and, depending on the environment, further lateral movement.

Attack surface

The vulnerability is reached locally through a crafted PDF file opened by the user; the CVSS vector shows AV:L, PR:N, and UI:R, meaning no authentication is required but user interaction (opening the document) is necessary. It can be delivered via email attachment, web download, or other file-sharing channels.

Exploitation

CVE-2013-0641 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and the description states it was exploited in the wild in February 2013. EPSS gives a 30-day probability of 0.32449 (98.2nd percentile), indicating high likelihood of exploitation activity.

What to do

• Apply the vendor updates referenced in Adobe security advisory APSB13-07 (or later) to move Reader and Acrobat to fixed versions (9.5.4, 10.1.6, 11.0.02 or above).
• For Linux distributions, apply the corresponding Red Hat, openSUSE, or SUSE errata that update the bundled Adobe Reader packages.
• Disable or restrict JavaScript execution in Adobe Reader/Acrobat and enable Protected Mode/Protected View where available.
• Block or sandbox PDF attachments at the email gateway and web proxy, and enforce a policy of opening PDFs only from trusted sources.
• If Reader/Acrobat cannot be patched immediately, consider using an alternative PDF viewer or isolating the application in a hardened virtual machine.

Detection

• Monitor for processes spawning from Adobe Reader/Acrobat (e.g., cmd.exe, powershell.exe, wscript.exe) as a child process, which may indicate successful exploitation.
• Inspect PDF files for embedded JavaScript, shellcode patterns, or unusual object streams using static analysis or YARA rules targeting known exploit PDFs.
• Review endpoint logs for crashes or buffer overflow exceptions in AcroRd32.exe or Acrobat.exe, especially following the opening of email attachments.
• Use network detection to identify PDF downloads from untrusted sources and correlate with subsequent suspicious outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.