Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Adobe Reader and Acrobat older versions can run malicious code

CVE-2016-1084 · published 10 years ago
Summary

Versions of Adobe Reader and Acrobat older than the latest updates for Windows and macOS may allow a attacker to execute code on a computer or cause it to crash. This happens through a memory handling flaw that can be triggered by opening a crafted file. Updating to the newest Adobe Reader or Acrobat release fixes the issue and restores normal security.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe acrobat <= 11.0.15
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
adobe acrobat_dc <= 15.006.30121
<= 15.010.20060
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*
adobe acrobat_reader_dc <= 15.006.30121
<= 15.010.20060
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*
adobe reader <= 11.0.15
cpe:2.3:a:adobe:reader:*:*:*:*:*:*:*:*
Original advisory text
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attack...
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published11 May 2016
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-1084 · NVD
Track software like this
Free during beta