Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Adobe Acrobat Reader can let attackers raise privileges

CVE-2015-5090 · published 11 years ago
Summary

Older versions of Adobe Acrobat and Acrobat Reader on Windows and macOS can be tricked into ignoring their normal security limits, allowing a malicious program to move from a low‑trust level to a medium‑trust level. This escalation lets an attacker gain more control over the system than intended. Upgrade to the latest Adobe Acrobat/Reader versions or apply the security patches released by Adobe.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe acrobat >= 10.0, <= 10.1.14
>= 11.0.0, <= 11.0.11
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
adobe acrobat_dc >= 15.006.30033, < 15.006.30060
>= 15.007.20033, < 15.008.20082
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*
adobe acrobat_reader >= 10.0, <= 10.1.14
>= 11.0.0, <= 11.0.11
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
adobe acrobat_reader_dc >= 15.006.30033, < 15.006.30060
>= 15.007.20033, < 15.008.20082
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*
Original advisory text
Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082...
Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-4446 and CVE-2015-5106.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published15 Jul 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-5090 · NVD
Track software like this
Free during beta