Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Adobe Reader/Acrobat may run malicious code from U3D file

CVE-2011-0595 · published 15 years ago
Summary

Older versions of Adobe Reader and Acrobat on Windows and Mac can be tricked by a specially crafted 3D file into executing code the attacker supplies. This happens because the program mishandles the file during decompression, potentially letting an attacker take control of the computer. Upgrade to the latest version of Reader or Acrobat, or apply any available patches, to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe acrobat_reader 8.0
8.1
8.1.1
8.1.2
8.1.4
8.1.5
8.1.6
8.1.7
8.2
8.2.1
8.2.2
8.2.3
15 more version ranges
cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
adobe acrobat 8.0
8.1
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.2
8.2.1
8.2.2
16 more version ranges
cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
Original advisory text
Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file th...
Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression, a different vulnerability than CVE-2011-0590, CVE-2011-0591, CVE-2011-0592, CVE-2011-0593, and CVE-2011-0600.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published10 Feb 2011
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2011-0595 · NVD
Track software like this
Free during beta