Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-2862 — Integer Overflow or Wraparound in Adobe Acrobat

CWE-189CWE-190 — Integer Overflow or Wraparound9 documents7 sources
Severity
9.3CRITICALNVD
EPSS
37.6%
top 2.79%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Adobe AcrobatAdobe Acrobat Reader
Timeline
PublishedAug 5
Latest updateMay 17

Description

Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDadobe/acrobat_reader8.2.3, 9.3.3+1
▶NVDadobe/acrobat9.3.3

🔴Vulnerability Details

2
GHSA
GHSA-ghwm-gwr7-m4m2: Integer overflow in CoolType↗2022-05-17
▶
VulnCheck
Adobe Reader CoolType.dll Remote Code Execution↗2010
▶

💥Exploits & PoCs

1
Exploit-DB
Acrobat Acrobat - Font Parsing Integer Overflow↗2010-08-14
▶

📋Vendor Advisories

1
Red Hat
acroread: integer overflow flaw allows remote arbitrary code execution↗2010-08-04
▶

🕵️Threat Intelligence

2
Tenable
Tenable Network Security Podcast - Episode 46↗2010-08-19
▶
Tenable
Tenable Network Security Podcast - Episode 46↗2010-08-19
▶

💬Community

2
Bugzilla
acroread: multiple critical security flaws (APSB10-17)↗2010-08-17
▶
Bugzilla
CVE-2010-2862 acroread: integer overflow flaw allows remote arbitrary code execution↗2010-08-05
▶
CVE-2010-2862 — Integer Overflow or Wraparound in Adobe | cvebase