Adobe Acrobat Reader

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.

• CVE-2008-2992Adobe Reader and Acrobat Input Validation VulnerabilityRansomware

  7.8 high · locally only, without login, needs user action · CISA deadline was 24 Mar 22

• CVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityRansomware

  7.8 high · locally only, with a basic account · CISA deadline was 24 Mar 22

• CVE-2013-3346Adobe Reader and Acrobat Memory Corruption Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 24 Mar 22

• CVE-2013-2729Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 18 Apr 22

• CVE-2014-0546Adobe Reader and Acrobat Sandbox Bypass Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 15 Jun 22

• CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 22 Jun 22

• CVE-2021-28550Adobe Acrobat and Reader Use-After-Free Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 17 Nov 21

• CVE-2021-21017Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 17 Nov 21

• CVE-2014-0496Adobe Reader and Acrobat Use-After-Free Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 24 Mar 22

• CVE-2009-0927Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 15 Apr 22

• CVE-2008-0655Adobe Acrobat and Reader Unspecified Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2009-3953Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

  8.8 high · over the network, without login, needs user action · CISA deadline was 3 Jun

• CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution Vulnerability

  8.6 high · locally only, without login, needs user action · CISA deadline was 27 Apr

• CVE-2013-0640Adobe Reader and Acrobat Memory Corruption Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 24 Mar 22

• CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2009-1862Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2009-4324Adobe Acrobat and Reader Use-After-Free Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 22 Jun 22

• CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 5 Oct 23

• CVE-2023-21608Adobe Acrobat and Reader Use-After-Free Vulnerability

  7.8 high · locally only, without login, needs user action · CISA deadline was 31 Oct 23

• CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

  7.3 high · locally only, with a basic account, needs user action · CISA deadline was 22 Jun 22

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.