CVE-2013-3346: Adobe Reader and Acrobat memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation per CISA KEV, and very high EPSS probability make this an urgent patching priority.

What it is

Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 contain an out-of-bounds write (CWE-787) that corrupts memory. Successful exploitation lets an attacker execute arbitrary code or crash the application. The flaw is remotely reachable and requires no privileges or user interaction per the CVSS vector.

Impact

An attacker can execute arbitrary code in the context of the affected Reader or Acrobat process, or cause a denial of service. This can lead to full compromise of the user's system.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication (PR:N) and no user interaction (UI:N) per the CVSS vector, though the description does not specify the exact delivery vector. It is reached through the processing of malicious content by Adobe Reader or Acrobat.

Exploitation

CVE-2013-3346 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and has an EPSS 30-day probability of 0.78581 (99.564th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is documented.

What to do

• Apply the vendor update per Adobe security bulletin APSB13-15 to move to Reader/Acrobat 9.5.5, 10.1.7, or 11.0.03 or later.
• If patching is not immediately possible, disable or restrict the opening of untrusted PDF files and limit JavaScript in Reader/Acrobat.
• Enforce application allowlisting and least privilege so Reader/Acrobat do not run with administrative rights.
• Monitor CISA KEV guidance and ensure the due date (2022-03-24) remediation is completed.

Detection

• Hunt for unusual child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or scripting hosts.
• Monitor for crashes or memory corruption events in Adobe Reader/Acrobat via Windows Error Reporting or endpoint telemetry.
• Review proxy and email logs for PDF files delivered from untrusted sources, especially those matching known exploit patterns.
• Use EDR to detect exploitation primitives like heap spraying or return-oriented programming behavior in Reader/Acrobat processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.