Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file…

Published 18 y ago 2008-11-04 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.8

v3.1 · CNA

CISA KEV

Yes

added 2022-03-03

EPSS

99.8%

percentile 100%

Public exploits

Metasploit · Exploit-DB

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

Known exploited (CISA KEV)

Added: 4 y ago 2022-03-03
Due date: 2022-03-24 (4 y ago)
Ransomware use: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor / product: Adobe / Acrobat and Reader
CISA name: Adobe Reader and Acrobat Input Validation Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago 2025-02-10

Exploit prediction (EPSS)

99.79% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Metasploit exploit/windows/fileformat/adobe_utilprintf Adobe util.printf() Buffer Overflow · metasploit exploit, good rank · 2008-02-08
Metasploit exploit/windows/browser/adobe_utilprintf Adobe util.printf() Buffer Overflow · metasploit exploit, good rank · 2008-02-08
EDB-7006 Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (2) · local · 2008-11-05
EDB-6994 Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (1) · local · 2008-11-05
EDB-16624 Adobe - 'util.printf()' Local Buffer Overflow (Metasploit) (2) · local · 2010-09-25
EDB-16504 Adobe - 'util.printf()' Local Buffer Overflow (Metasploit) (1) · local · 2010-05-03

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
CNA	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	9.3	`AV:N/AC:M/Au:N/C:C/I:C/A:C`

Classification

Weakness

CWE-787 Out-of-bounds Write

References

securityfocus.com /bid/30035 · vdb-entry, x_refsource_BID, x_transferred
secunia.com /advisories/32700 · third-party-advisory, x_refsource_SECUNIA, x_transferred
support.nortel.com /go/main.jsp?cscat=BLTNDETAIL&id=909609 · x_refsource_CONFIRM, x_transferred
securityfocus.com /archive/1/498027/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
secunia.com /secunia_research/2008-14/ · x_refsource_MISC, x_transferred
securityfocus.com /bid/32091 · vdb-entry, x_refsource_BID, x_transferred
osvdb.org /49520 · vdb-entry, x_refsource_OSVDB, x_transferred
secunia.com /advisories/35163 · third-party-advisory, x_refsource_SECUNIA, x_transferred
download.oracle.com /sunalerts/1019937.1.html · vendor-advisory, x_refsource_SUNALERT, x_transferred
secunia.com /advisories/32872 · third-party-advisory, x_refsource_SECUNIA, x_transferred
exploit-db.com /exploits/7006 · exploit, x_refsource_EXPLOIT-DB, x_transferred
securityreason.com /securityalert/4549 · third-party-advisory, x_refsource_SREASON, x_transferred
coresecurity.com /content/adobe-reader-buffer-overflow · x_refsource_MISC, x_transferred
zerodayinitiative.com /advisories/ZDI-08-072/ · x_refsource_MISC, x_transferred
adobe.com /support/security/bulletins/apsb08-19.html · x_refsource_CONFIRM, x_transferred
securityfocus.com /archive/1/498055/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
exploit-db.com /exploits/6994 · exploit, x_refsource_EXPLOIT-DB, x_transferred
vupen.com /english/advisories/2009/0098 · vdb-entry, x_refsource_VUPEN, x_transferred
secunia.com /advisories/29773 · third-party-advisory, x_refsource_SECUNIA, x_transferred
us-cert.gov /cas/techalerts/TA08-309A.html · third-party-advisory, x_refsource_CERT, x_transferred
securitytracker.com /id?1021140 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /archive/1/498032/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
vupen.com /english/advisories/2008/3001 · vdb-entry, x_refsource_VUPEN, x_transferred
lists.opensuse.org /opensuse-security-announce/2008-11/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
redhat.com /support/errata/RHSA-2008-0974.html · vendor-advisory, x_refsource_REDHAT, x_transferred
kb.cert.org /vuls/id/593409 · third-party-advisory, x_refsource_CERT-VN, x_transferred
support.nortel.com /go/main.jsp?cscat=BLTNDETAIL&id=800801 · x_refsource_CONFIRM, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-2992 · government-resource

Sources

CVE List: CVE-2008-2992
NVD: CVE-2008-2992

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary