{"id":"CVE-2010-2883","published":"2010-09-09T22:00:02Z","modified":"2026-06-16T23:21:41Z","title":"Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability","vendor":"Adobe","product":"Acrobat and Reader","tier":"core","eol":{"product":"Adobe Reader/Acrobat 9","since":"2013-06-26","note":"No security updates; remove it."},"description":{"text":"Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow in the CoolType.dll component of Adobe Acrobat and Reader allows code execution or a crash when a PDF containing an oversized field in a Smart INdependent Glyphlets (SING) table within an embedded TTF font is processed. An attacker can achieve this by supplying a crafted PDF document, which requires the victim to open it in the affected application.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:06:53Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.81376,"percentile":0.99636,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-2883","provenance":"source"},"vulncheckKev":{"dateAdded":"2010-09-09","exploitedFirstSeen":"2010-09-09","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2883","date":"2010-09-09"},{"url":"https://documents.trendmicro.com/assets/wp/wp_luckycat_redux.pdf","date":"2012-01-01"},{"url":"https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf","date":"2012-01-01"},{"url":"https://1vx.ug/archive/Symantec/luckycat-hackers-12-en.pdf","date":"2012-03-01"},{"url":"https://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf","date":"2012-10-18"},{"url":"https://cybersecurity.att.com/blogs/labs-research/new-sykipot-developments","date":"2013-03-21"},{"url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf","date":"2014-02-01"},{"url":"https://securelist.com/the-spring-dragon-apt/70726/","date":"2015-06-17"},{"url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","date":"2016-01-24"},{"url":"https://cisa.gov/news-events/alerts/2015/04/29/top-30-targeted-high-risk-vulnerabilities","date":"2016-09-29"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html","tags":["Broken Link"]},{"url":"http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspx","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/41340","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/43025","tags":["Broken Link","Vendor Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201101-08.xml","tags":["Third Party Advisory"]},{"url":"http://www.adobe.com/support/security/advisories/apsa10-02.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-21.html","tags":["Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/491991","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0743.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/43057","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-279A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2331","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0191","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0344","tags":["Broken Link","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61635","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586","tags":["Broken Link"]},{"url":"http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html","tags":["Broken Link"]},{"url":"http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspx","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/41340","tags":["Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/43025","tags":["Broken Link","Vendor Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201101-08.xml","tags":["Third Party Advisory"]},{"url":"http://www.adobe.com/support/security/advisories/apsa10-02.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-21.html","tags":["Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/491991","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0743.html","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/43057","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-279A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2331","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0191","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0344","tags":["Broken Link","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61635","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2883","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.","confidence":"high"},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution.","confidence":"high"}],"reports":[{"id":"SRC-62aa640e098a9c9dc263","title":"Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","date":"2016-01-24","mentions":[{"quote":"- CVE-2010-2883","start":8983,"end":8998}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-2887","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2887","exploited":true,"exploitedSince":"2022-06-08","provenance":"source"},"exploits":[{"id":16494,"url":"https://www.exploit-db.com/exploits/16494","title":"Adobe CoolType - SING Table 'uniqueName' Remote Stack Buffer Overflow (Metasploit) (1)","type":"remote","platform":"windows","date":"2010-09-20","verified":true,"provenance":"source"},{"id":16619,"url":"https://www.exploit-db.com/exploits/16619","title":"Adobe CoolType - SING Table 'uniqueName' Local Stack Buffer Overflow (Metasploit) (2)","type":"local","platform":"windows","date":"2010-09-25","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2010-09-20"},"pocGithub":{"count":1,"skipped":0,"earliest":"2025-09-22","earliestUrl":"https://github.com/avielzecharia/CVE-2010-2883","repos":[{"name":"avielzecharia/CVE-2010-2883","url":"https://github.com/avielzecharia/CVE-2010-2883","stars":1,"created":"2025-09-22"}]},"metasploit":[{"name":"Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow","module":"exploit/windows/browser/adobe_cooltype_sing","type":"exploit","disclosureDate":"2010-09-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_cooltype_sing.rb"},{"name":"Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow","module":"exploit/windows/fileformat/adobe_cooltype_sing","type":"exploit","disclosureDate":"2010-09-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb"}],"first":{"date":"2010-09-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_cooltype_sing.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"},{"stage":"primary","techniques":["T1027"],"provenance":"source"},{"stage":"secondary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2010-09-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2010-09-20, PoC-in-GitHub 2025-09-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_cooltype_sing.rb","provenance":"source"},{"date":"2010-09-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2883","provenance":"source"},{"date":"2010-09-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2010-2883","provenance":"source"},{"date":"2016-01-24","kind":"report","label":"Named in unit42.paloaltonetworks.com: Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","provenance":"machine"},{"date":"2022-06-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2887","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4290},"priority":{"score":56.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5894 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9964"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 1 PoC-in-GitHub repo; 2 Metasploit modules"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-787"}}