{"id":"CVE-2011-2462","published":"2011-12-07T19:55:01Z","modified":"2026-06-16T23:31:23Z","title":"Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability","vendor":"Adobe","product":"Reader and Acrobat","tier":"core","eol":{"product":"Adobe Reader/Acrobat X","since":"2015-11-15","note":"No security updates; remove it."},"description":{"text":"Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the U3D component of Adobe Reader and Acrobat 10.1.1 and earlier (Windows and Mac OS X) and Adobe Reader 9.x through 9.4.6 (UNIX) causes memory corruption, categorised as an out-of-bounds write. An remote attacker who supplies crafted input through unknown vectors, with no authentication or user interaction required, can execute arbitrary code or cause a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:04:00Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.88581,"percentile":0.99772,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2011-2462","provenance":"source"},"vulncheckKev":{"dateAdded":"2011-12-07","exploitedFirstSeen":"2011-12-07","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2462","date":"2011-12-07"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=748f518d-25e3-456c-a623-595f9b5214ef&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments","date":"2011-12-08"},{"url":"https://documents.trendmicro.com/assets/wp/wp_luckycat_redux.pdf","date":"2012-01-01"},{"url":"https://cybersecurity.att.com/blogs/labs-research/new-sykipot-developments","date":"2013-03-21"},{"url":"https://d2538mqrb7brka.cloudfront.net/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf","date":"2014-02-01"},{"url":"https://blogs.cisco.com/security/talos/opening-zxshell","date":"2014-10-28"},{"url":"https://cisa.gov/news-events/alerts/2015/04/29/top-30-targeted-high-risk-vulnerabilities","date":"2016-09-29"},{"url":"https://www.us-cert.gov/ncas/alerts/TA15-119A","date":"2016-09-29"},{"url":"https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/#ref3","date":"2020-05-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-08"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html","tags":["Broken Link"]},{"url":"http://www.adobe.com/support/security/advisories/apsa11-04.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb11-30.html","tags":["Not Applicable"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb12-01.html","tags":["Not Applicable"]},{"url":"http://www.redhat.com/support/errata/RHSA-2012-0011.html","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA11-350A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html","tags":["Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html","tags":["Broken Link"]},{"url":"http://www.adobe.com/support/security/advisories/apsa11-04.html","tags":["Vendor Advisory"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb11-30.html","tags":["Not Applicable"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb12-01.html","tags":["Not Applicable"]},{"url":"http://www.redhat.com/support/errata/RHSA-2012-0011.html","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA11-350A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562","tags":["Broken Link"]},{"url":"https://github.com/cisagov/vulnrichment/issues/199","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ai-mapping"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Memory Management; claude-haiku-5-5: user opens malicious PDF triggering U3D","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":163,"end":212}],"comment":"This vulnerability is exploited by having the user open a malicious pdf file to achieve arbitrary code execution.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution from memory corruption","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":163,"end":212}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: denial of service via memory corruption","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause a denial of service (memory corruption)","start":216,"end":261}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-a7dfc4dbf8b0acd1f56a","title":"Threat Spotlight: Group 72, Opening the ZxShell","publisher":"blogs.cisco.com","url":"https://blogs.cisco.com/security/talos/opening-zxshell","date":"2014-10-28","mentions":[{"quote":"ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.","start":3357,"end":3533}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2011-2451","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-2451","exploited":true,"exploitedSince":"2022-06-08","provenance":"source"},"exploits":[{"id":18366,"url":"https://www.exploit-db.com/exploits/18366","title":"Adobe Reader - U3D Memory Corruption (Metasploit)","type":"local","platform":"windows","date":"2012-01-14","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2012-01-14"},"metasploit":[{"name":"Adobe Reader U3D Memory Corruption Vulnerability","module":"exploit/windows/fileformat/adobe_reader_u3d","type":"exploit","disclosureDate":"2011-12-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_reader_u3d.rb"}],"first":{"date":"2011-12-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_reader_u3d.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059","T1499"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2011-12-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2012-01-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_reader_u3d.rb","provenance":"source"},{"date":"2011-12-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2462","provenance":"source"},{"date":"2011-12-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2011-2462","provenance":"source"},{"date":"2014-10-28","kind":"report","label":"Named in blogs.cisco.com: Threat Spotlight: Group 72, Opening the ZxShell","url":"https://blogs.cisco.com/security/talos/opening-zxshell","provenance":"machine"},{"date":"2022-06-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-2451","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3836},"priority":{"score":58.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5440 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-787"}}