CVE-2016-4252 is a critical memory corruption vulnerability affecting Adobe Reader and Acrobat on both Windows and OS X platforms, including versions before 11.0.17, Acrobat/Reader DC Classic before 15.006.30198, and Acrobat/Reader DC Continuous before 15.017.20050. This flaw allows unauthenticated attackers to execute arbitrary code or cause a denial of service through unspecified vectors. With a CVSSv3 score of 9.8 (CRITICAL), this vulnerability is highly severe, requiring no user interaction or privileges and having a low attack complexity. Successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system. While there is no evidence of active exploitation (not in KEV), and no public exploit code is available via Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 11.0.16CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* | ||
<= 15.006.30174CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* | ||
<= 15.016.20045CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* | ||
<= 15.006.30174CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* | ||
<= 15.016.20045CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.