Is CVE-2010-2883 being actively exploited?

Yes. CVE-2010-2883 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on June 8, 2022.

What is the CVSS score for CVE-2010-2883?

CVE-2010-2883 has a CVSS 3.1 base score of 7.3 (HIGH).

CVE-2010-2883

HIGH · CVSS 7.3CISA KEV: actively exploitedEPSS 81.4%EU EUVD: exploited

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

Key facts

CVSS score: 7.3 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
EPSS score: 81.4% (100th percentile)
In CISA KEV: Yes, added June 8, 2022
In EU EUVD: Yes (EUVD-2010-2887)
Published: September 9, 2010
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

Added to the KEV catalog on June 8, 2022; federal remediation due June 22, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2010-2887 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

adobe / acrobat
adobe / acrobat reader
apple / macos
microsoft / windows

References

http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html(Broken Link)
http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspx(Broken Link)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html(Broken Link)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html(Broken Link)
http://secunia.com/advisories/41340(Broken Link, Vendor Advisory)
http://secunia.com/advisories/43025(Broken Link, Vendor Advisory)
http://security.gentoo.org/glsa/glsa-201101-08.xml(Third Party Advisory)
http://www.adobe.com/support/security/advisories/apsa10-02.html(Vendor Advisory)
http://www.adobe.com/support/security/bulletins/apsb10-21.html(Vendor Advisory)
http://www.kb.cert.org/vuls/id/491991(Third Party Advisory, US Government Resource)
http://www.redhat.com/support/errata/RHSA-2010-0743.html(Broken Link)
http://www.securityfocus.com/bid/43057(Broken Link, Third Party Advisory, VDB Entry)
http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt(Broken Link)
http://www.us-cert.gov/cas/techalerts/TA10-279A.html(Third Party Advisory, US Government Resource)
http://www.vupen.com/english/advisories/2010/2331(Broken Link, Vendor Advisory)
http://www.vupen.com/english/advisories/2011/0191(Broken Link, Vendor Advisory)
http://www.vupen.com/english/advisories/2011/0344(Broken Link, Vendor Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61635(Third Party Advisory, VDB Entry)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586(Broken Link)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2883(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain