8.8High KEV

CVE-2013-2729Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

adobe acrobat; adobe acrobat reader; suse linux enterprise desktop; redhat enterprise linux desktop Published: 2013-05-16 13:00 (13 years ago)

Known exploited — Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 28.03.2022. Remediation deadline for US federal agencies: 18.04.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-2729

Description

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

Weakness (CWE): CWE-190

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
adobe	acrobat	9.0 – < 9.5.5
adobe	acrobat reader	9.0 – < 9.5.5
redhat	enterprise linux desktop	6.0
redhat	enterprise linux eus	5.9
redhat	enterprise linux server	6.0
redhat	enterprise linux server aus	5.9
redhat	enterprise linux workstation	6.0
suse	linux enterprise desktop	10

References and patches

http://www.adobe.com/support/security/bulletins/apsb13-15.html Not ApplicablePatchVendor Advisory
SUSE-SU-2013:0809 vendor-advisoryMailing ListThird Party Advisory
RHSA-2013:0826 vendor-advisoryThird Party Advisory
oval:org.mitre.oval:def:16717 vdb-entrysignatureBroken Link
GLSA-201308-03 vendor-advisoryThird Party Advisory
https://github.com/cisagov/vulnrichment/issues/199 Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2729 US Government Resource

CPE matches (NVD) (15)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* ≥ 9.0 < 9.5.5
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* ≥ 10.0 < 10.1.7
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* ≥ 11.0 < 11.0.03
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* ≥ 9.0 < 9.5.5
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* ≥ 10.0 < 10.1.7
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* ≥ 11.0 < 11.0.03
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

CVSS score

8.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	8.8High
nvd	CVSS 3.1	9.8Critical
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8High
nvd	CVSS 2.0	10.0High

EPSS (chance of exploitation in 30 days)

66.55%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2013-03-28
Published2013-05-16 13:00
Reached IP-DB2026-10-24 23:33
Added to KEV2022-03-28
Last updated2026-06-17 02:53

Assigned by (CNA): adobe
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Adobe Acrobat / Reader

8.8High

CVE-2026-100134 13 days ago

Acrobat for Edge | Out-of-bounds Write (CWE-787)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

4.3Medium

CVE-2026-100132 13 days ago

Acrobat for Edge | Out-of-bounds Read (CWE-125)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…

5.5Medium

CVE-2026-81984 1 month ago

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a vic…

7.8High

CVE-2026-81989 1 month ago

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

5.5Medium

CVE-2026-81991 1 month ago

Acrobat Reader | Out-of-bounds Read (CWE-125)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that …

7.8High

CVE-2026-81980 1 month ago

Acrobat Reader | Out-of-bounds Write (CWE-787)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.