CVE-2019-7109

Exploitation likely. EPSS gives it a 15% chance of exploitation in the next 30 days. Fixed in 15.006.30493.

CVSS 3.06.5Medium EPSS percentile97th15% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix15.006.30493Upgrade to this build

Published 2019-05-23Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Adobe Acrobat and ReaderAffected: 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and…Upgrade to: not statedStated by: CVE record
Adobe Acrobat DcAffected: ≥ 15.006.30060, < 15.006.30493Upgrade to: 15.006.30493Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

In Adobe Acrobat, open Help > About Adobe Acrobat and compare the installed version with the affected versions.
If you use Adobe Acrobat DC, install version 15.006.30493 or later using Adobe's updater or your normal software-management tool.
Until updated, warn staff not to open unexpected PDF documents, especially files received by email or links from unfamiliar senders.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

In plain language

Written by AI from the record

Adobe Acrobat versions 2019.010.20098 and earlier, 2017.011.30127 and earlier, or 2015.006.30482 and earlier can expose sensitive information if someone opens a malicious document, so affected businesses should update.

CWE-125 out-of-bounds read in Adobe Acrobat and Reader allows unauthenticated remote information disclosure through a specially crafted document that a user opens or views.

If you're affected

Sensitive data exposure
Document content disclosure
Employee-targeted phishing risk
Privacy incident risk

What is it

This is a flaw in Adobe Acrobat that can cause it to reveal information it should keep protected when reading a booby-trapped document. It is like a filing clerk being handed a fake form that makes them accidentally show pages from a nearby confidential file.

Who is affected

This matters to you if your business uses Adobe Acrobat to open or view PDF documents. An attacker does not need an account on your systems, but a person must open or view the malicious document for the issue to occur.

How urgent is it

An attacker must get someone at your business to open a specially made document, which limits immediate risk. This is a green-priority issue: it is not listed as actively exploited by CISA, and no public exploit code is on record, but update affected installations in your normal maintenance cycle.

What to do — in detail

Confirm exposure by identifying installed Adobe Acrobat versions through Help > About Adobe Acrobat, endpoint-management inventory, or installed-software reports. The available patch finding specifies Adobe Acrobat DC 15.006.30493 as the fixed version; upgrade affected Acrobat DC installations to that version or a later supported release.

No branch-specific fixed versions beyond Acrobat DC 15.006.30493 were provided in the findings, so validate the appropriate current release for other installed Acrobat lines with Adobe before deployment. If patching is delayed, reduce exposure by blocking or quarantining unsolicited PDF attachments and warning users not to open unexpected PDFs. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor email-security and endpoint alerts for suspicious PDF attachments or unusual Acrobat crashes around document opening.

Technical context

CVE-2019-7109 is rated CVSS 6.5 (Medium) and is a CWE-125 out-of-bounds read leading to information disclosure. The network attack vector requires no authentication but does require user interaction: a target must open or view a crafted document. It is not listed in CISA KEV and no public exploit code is on record. EPSS predicts a 15.1% likelihood (97th percentile), with a rising trend; this is predictive rather than confirmation of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

15% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 2680 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band changelow → moderateepss band change
2026-08-28EPSS band changemoderate → lowepss band change

Affected products

Adobecommercial · USaka adobe systems inc.
- Adobe Acrobat and ReaderDesktop AppConsumer Software / productivity
- acrobat reader dcDesktop AppOn-premConsumer Software / productivity

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact