$ cve CVE-2011-2462 JSON

CVE-2011-2462 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 88.5% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-06-22.

Description

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	88.52% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-787
On CISA KEV	yes — remediate by 2022-06-22
Public exploit	yes
Published	2011-12-07
Last modified	2026-06-16

CISA KEV

Name	Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Added	2022-06-08
Due	2022-06-22
Vendor / product	Adobe / Reader and Acrobat
Ransomware use	none reported

Affected (5)

Vendor	Product
adobe	acrobat
adobe	acrobat reader
apple	mac os x
microsoft	windows
opengroup	unix

Public exploits

Source	Title	Date
exploit-db	Adobe Reader - U3D Memory Corruption (Metasploit)	2012-01-14

References

→ the Explorer · watch your stack · NVD