CVE-2019-7111: Adobe Acrobat and Reader out-of-bounds write allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityHigh CVSS (8.8) code-execution flaw in widely deployed software with very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is provided.

What it is

Adobe Acrobat and Reader (DC, 2017, and 2015 tracks) contain an out-of-bounds write (CWE-787) in versions 2019.010.20098 and earlier, 2017.011.30127 and earlier, and 2015.006.30482 and earlier. A crafted PDF can corrupt memory and lead to arbitrary code execution in the context of the user opening the file. The flaw is remotely reachable and rated CVSS 3.0 8.8 (HIGH).

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the Acrobat/Reader process, enabling installation of malware, data theft, or further lateral movement on the host.

Attack surface

Reached by delivering a malicious PDF that the victim opens in Acrobat or Reader; the vector is network (AV:N) with no privileges required (PR:N) but user interaction (UI:R) is required to open the file.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high (0.55894, 98.996th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Patch Acrobat and Reader to the fixed versions in Adobe security bulletin APSB19-17 immediately.
• If patching cannot be done at once, disable or restrict JavaScript in Acrobat/Reader and enable Protected View/Protected Mode.
• Block untrusted PDF attachments at email and web gateways and warn users against opening unexpected PDFs.
• Where feasible, open PDFs in a hardened or sandboxed viewer rather than full Acrobat/Reader.
• Track affected endpoints and confirm the installed Acrobat/Reader build is above the vulnerable version thresholds.

Detection

• Monitor for Acrobat/Reader (AcroRd32.exe, Acrobat.exe) spawning child processes such as cmd.exe, powershell.exe, or scripting hosts.
• Alert on Acrobat/Reader crashes or memory-corruption events (Windows Error Reporting, application fault logs) tied to recently opened PDFs.
• Hunt for PDFs written to temp or download directories shortly before suspicious process creation on hosts running vulnerable builds.
• Review endpoint telemetry for unusual file writes or network connections originating from Acrobat/Reader processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.