CVE-2011-2462
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 22 June 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 88.58% probability · 100th percentile
- Public exploits
- 1 in Exploit-DB · verified · first 14 January 2012
- CISA KEV
- Listed 8 June 2022 · due 22 June 2022
- Weakness
- CWE-787
- Affected
- adobe/acrobat · adobe/acrobat reader
- Source
- psirt@adobe.com
EPSS moved from 88.5% on 24 September 2026 to 88.6% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2011-2462
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.htmlBroken Link
- http://www.adobe.com/support/security/advisories/apsa11-04.htmlVendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb11-30.htmlNot Applicable
- http://www.adobe.com/support/security/bulletins/apsb12-01.htmlNot Applicable
- http://www.redhat.com/support/errata/RHSA-2012-0011.htmlBroken Link
- http://www.us-cert.gov/cas/techalerts/TA11-350A.htmlThird Party Advisory, US Government Resource
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.htmlBroken Link
- http://www.adobe.com/support/security/advisories/apsa11-04.htmlVendor Advisory
- http://www.adobe.com/support/security/bulletins/apsb11-30.htmlNot Applicable
- http://www.adobe.com/support/security/bulletins/apsb12-01.htmlNot Applicable
- http://www.redhat.com/support/errata/RHSA-2012-0011.htmlBroken Link
- http://www.us-cert.gov/cas/techalerts/TA11-350A.htmlThird Party Advisory, US Government Resource
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562Broken Link
- https://github.com/cisagov/vulnrichment/issues/199Issue Tracking
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.