Skip to content
OpenAdvisories
Unscored Public exploit CVE-2010-1240 EUVD-2010-1270GHSA-r9c9-qvgh-48mx

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in …

Published Apr 5, 2010 · Updated Aug 7, 2024 · Assigned by mitre

Description

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 acroread +1 9.3.3-1.el5 RHSA-2010:0503
RHEL 4 acroread +1 9.3.3-2.el4 RHSA-2010:0503

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 2 modules

Exploit-DB 3

GitHub 5 repositories

  • Jasmoon99/Embedded-PDF ★ 71 · Jun 5, 2021

    This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public a…

  • omarothmann/Embedded-Backdoor-Connection ★ 8 · Jan 26, 2022

    This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public a…

  • asepsaepdin/CVE-2010-1240 ★ 1 · Aug 2, 2023
  • ocfagb/hacktivity-vulns-exploits-lab ★ 0 · Aug 27, 2026

    Writeup + CVE analysis + countermeasures for the Hacktivity 'Vulnerabilities, Exploits, and Remote Access Payloads' lab (netcat shells, Metasploit, CVE-2010-1240, CVE-2004-2687).

  • 12345qwert123456/CVE-2010-1240 ★ 0 · Sep 17, 2025

    Python tool for CVE-2010-1240 research - generates malicious PDFs exploiting Adobe Reader Launch Actions

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References