CVE-2011-2462

CVE-2011-2462 is a critical-severity (CVSS 9.8) vulnerability in Adobe Reader and Acrobat. CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 22, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html
• http://www.adobe.com/support/security/advisories/apsa11-04.html
• http://www.adobe.com/support/security/bulletins/apsb11-30.html
• http://www.adobe.com/support/security/bulletins/apsb12-01.html
• http://www.redhat.com/support/errata/RHSA-2012-0011.html
• http://www.us-cert.gov/cas/techalerts/TA11-350A.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562