CVE-2013-3346

CVE-2013-3346 is a critical-severity (CVSS 9.8) vulnerability in Adobe Reader and Acrobat. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 24, 2022. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.

Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://www.adobe.com/support/security/bulletins/apsb13-15.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19054
• http://www.adobe.com/support/security/bulletins/apsb13-15.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19054
• https://github.com/cisagov/vulnrichment/issues/199
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3346