CVE-2008-2549

Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a...

4.3 MediumPublic exploitFix available

Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed PDF document, as demonstrated by 2008-HI2.pdf.

Exploit likelihood

52.6%Down 20.0 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2008-2549
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-2549
Updated: 2026-11-02

EUVDEUVD-2008-2544 No score

Record: EUVD-2008-2544
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6h86-qrjc-gvq6 No score

Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a...

Record: GHSA-6h86-qrjc-gvq6
Updated: 2026-11-02

Affected products

adobe acrobat reader

Affected packages

Affected packages
Package	Affected	Fixed
`acroread` Red Hat:rhel_extras:3	before 0:8.1.3-1	0:8.1.3-1
`acroread-plugin` Red Hat:rhel_extras:3	before 0:8.1.3-1	0:8.1.3-1
`acroread` Red Hat:rhel_extras:4	before 0:8.1.3-1.el4	0:8.1.3-1.el4
`acroread-plugin` Red Hat:rhel_extras:4	before 0:8.1.3-1.el4	0:8.1.3-1.el4
`acroread` Red Hat:rhel_extras:5::client	before 0:8.1.3-1.el5	0:8.1.3-1.el5
`acroread-plugin` Red Hat:rhel_extras:5::client	before 0:8.1.3-1.el5	0:8.1.3-1.el5
`acroread` Red Hat:rhel_extras:5::server	before 0:8.1.3-1.el5	0:8.1.3-1.el5
`acroread-plugin` Red Hat:rhel_extras:5::server	before 0:8.1.3-1.el5	0:8.1.3-1.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Adobe Acrobat Reader 8.1.2 - '.PDF' Remote Denial of Service (PoC)	2008-05-29

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2549 is a medium vulnerability (CVSS 4.3) in Adobe Acrobat Reader, published June 4, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 52.6%, the 98th percentile. Fixed in acroread 0:8.1.3-1.

References

Show 48 moreShow less