CVE-2010-1240

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not...

9.3 HighPublic exploit

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.

Exploit likelihood

73.6%Up 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2010-1240
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-1240
Updated: 2026-11-02

EUVDEUVD-2010-1270 No score

Record: EUVD-2010-1270
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r9c9-qvgh-48mx No score

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not...

Record: GHSA-r9c9-qvgh-48mx
Updated: 2026-11-02

Affected products

adobe acrobat reader

Affected packages

Affected packages
Package	Affected	Fixed
`acroread` Red Hat:rhel_extras:4 From an advisory covering 17 CVEs	before 0:9.3.3-2.el4	0:9.3.3-2.el4
`acroread-plugin` Red Hat:rhel_extras:4 From an advisory covering 17 CVEs	before 0:9.3.3-2.el4	0:9.3.3-2.el4
`acroread` Red Hat:rhel_extras:5::client From an advisory covering 17 CVEs	before 0:9.3.3-1.el5	0:9.3.3-1.el5
`acroread-plugin` Red Hat:rhel_extras:5::client From an advisory covering 17 CVEs	before 0:9.3.3-1.el5	0:9.3.3-1.el5
`acroread` Red Hat:rhel_extras:5::server From an advisory covering 17 CVEs	before 0:9.3.3-1.el5	0:9.3.3-1.el5
`acroread-plugin` Red Hat:rhel_extras:5::server From an advisory covering 17 CVEs	before 0:9.3.3-1.el5	0:9.3.3-1.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Adobe PDF Embedded EXE Social Engineering	2010-03-29
Metasploit	Adobe PDF Escape EXE Social Engineering (No JavaScript)	2010-03-29
Exploit-DB	Adobe Reader - Escape From '.PDF' Execute Embedded Executable	2010-03-31
Exploit-DB	Adobe PDF - Embedded EXE Social Engineering (Metasploit)	2010-12-16
Exploit-DB	Adobe PDF - Escape EXE Social Engineering (No JavaScript) (Metasploit)	2010-12-16
PoC in GitHub	Jasmoon99/Embedded-PDF	2021-06-05
PoC in GitHub	omarothmann/Embedded-Backdoor-Connection	2022-01-26
PoC in GitHub	asepsaepdin/CVE-2010-1240	2023-08-02
PoC in GitHub	12345qwert123456/CVE-2010-1240	2025-09-17
PoC in GitHub	ocfagb/hacktivity-vulns-exploits-lab	2026-08-27

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-1240 is a high vulnerability (CVSS 9.3) in Adobe Acrobat Reader, published April 5, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 73.6%, the 99th percentile. No source names a fixed version.

References

Show 61 moreShow less