Vulnerability record · CVE-2013-2729 · published 16 May 2013
CVE-2013-2729: Adobe Reader and Acrobat integer overflow allows code execution
Adobe · Acrobat
Adobe Reader and Acrobat contain an integer overflow (CWE-190) that can be triggered by unspecified vectors, leading to arbitrary code execution. It affects 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03, and is distinct from CVE-2013-2727. Because the flaw is remotely reachable with no privileges or user interaction per the CVSS vector, it is a serious risk to anyone running an unpatched version.
Description
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, confirmed KEV exploitation, and a very high EPSS probability make this an urgent patch target.
What it is
Adobe Reader and Acrobat contain an integer overflow (CWE-190) that can be triggered by unspecified vectors, leading to arbitrary code execution. It affects 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03, and is distinct from CVE-2013-2727. Because the flaw is remotely reachable with no privileges or user interaction per the CVSS vector, it is a serious risk to anyone running an unpatched version.
Impact
An attacker can execute arbitrary code in the context of the affected Reader or Acrobat process, giving full control of confidentiality, integrity, and availability on the host.
Attack surface
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N, indicating network reachability with no authentication and no user interaction required. The description does not specify the exact vectors, so the precise delivery mechanism (for example a crafted document) is not stated in the record.
Exploitation
CVE-2013-2729 is listed in CISA KEV (added 2022-03-28, due 2022-04-18), confirming known exploitation in the wild, and EPSS shows a 30-day probability of 0.66555 (99.2nd percentile). No ransomware campaign use is documented in the record.
What to do
- Apply the vendor patch per Adobe APSB13-15; upgrade Reader/Acrobat to 9.5.5, 10.1.7, or 11.0.03 or later as applicable.
- Apply the referenced SUSE, Red Hat, and Gentoo advisories for bundled or Linux distribution packages.
- If immediate patching is not possible, restrict or disable browser and email client integration for Reader/Acrobat and block untrusted PDF sources.
- Retire or isolate end-of-life Reader/Acrobat 9.x, 10.x, and 11.x installations that cannot be brought to a fixed release.
Detection
- Hunt for Reader/Acrobat process versions below 9.5.5, 10.1.7, or 11.0.03 across endpoints.
- Monitor for Reader/Acrobat spawning child processes such as cmd.exe, powershell.exe, or script interpreters, which is abnormal for normal document viewing.
- Review proxy, email, and file-share logs for PDFs delivered from untrusted external sources to hosts running affected versions.
- Alert on crashes or memory-corruption events in Reader/Acrobat that correlate with recently opened PDF files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2013-2729 to the Known Exploited Vulnerabilities catalog on 28 March 2022 as "Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 18 April 2022.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-2729 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2729), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
