CVE-2019-7761

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.8High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2019-05-22Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Adobe Acrobat and ReaderAffected: 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and…Upgrade to: not statedStated by: CVE record
Adobe Acrobat DcAffected: ≥ 15.006.30060, ≤ 15.006.30495Upgrade to: after 15.006.30495Affected: ≥ 15.006.30060, ≤ 15.006.30493Upgrade to: after 15.006.30493Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Adobe Acrobat or Acrobat Reader version you have installed (Help → About).
If your version is one of the listed “and earlier” versions, plan an immediate update.
Update Adobe Acrobat/Reader to the fixed version(s) provided by Adobe in APSB19-18.
After updating, confirm the new version number appears in Help → About and that document opening works as expected.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

In plain language

Written by AI from the record

CVE-2019-7761 is a serious security bug in older Adobe Acrobat/Acrobat Reader versions that can let an attacker run code when you open a crafted file; if you use these versions, you should update soon.

CVE-2019-7761 is a use-after-free vulnerability in affected Adobe Acrobat and Reader releases; it is triggered by opening a specially crafted document and can lead to arbitrary code execution (public exploit code exists).

If you're affected

Full system compromise
Malware installation risk
Ransomware risk
Business disruption

What is it

This flaw is like a memory-management mistake: after the program uses some information, it later tries to use it again as if it were still valid. Attackers can take advantage of that mistake with a specially made document, and that can let them take control of your computer when someone opens the file.

Who is affected

This matters if your business runs Adobe Acrobat or Adobe Acrobat DC on any workstation where employees open PDFs or other documents. The risk is mainly when the vulnerable app is exposed to a crafted file coming from email, the web, or other downloads. There is no confirmed “always reachable” network exposure noted here; the practical gate is whether an attacker can get a malicious document to someone who opens it in the vulnerable Acrobat version.

How urgent is it

This is a real, serious bug with a public exploit available, which increases the chance attackers will use it against unpatched systems. Even without a confirmed CISA KEV listing, the combination of high severity and available weaponized code makes this an urgent patching task for any affected Acrobat installs. Treat this as a near-term update priority (Amber).

What to do — in detail

Identify exposure
- On each affected machine, open Adobe Acrobat/Reader and go to Help → About.
- Record the exact version number.
- Compare it to the affected ranges called out in the CVE description: 2019.010.20100 and earlier; 2019.010.20099 and earlier; 2017.011.30140 and earlier; 2017.011.30138 and earlier; 2015.006.30495 and earlier; 2015.006.30493 and earlier.
Apply the fix
- Use Adobe’s remediation guidance for APSB19-18 (vendor remediation is provided in the findings).
- Upgrade Acrobat/Reader to the fixed version(s) listed in that advisory.
- After installation, re-check Help → About to confirm you are on a fixed version.
If patching is delayed (workarounds)
- Limit who can open untrusted PDFs and documents, especially from email attachments or unexpected links.
- Encourage staff to use a “preview/verify” workflow (e.g., open in a safer viewer or verify the source) until patching is complete.
- Disable or restrict risky document sources to reduce the odds a crafted file reaches a vulnerable install.
What to monitor
- Look for unexpected crashes or unusual behavior in Acrobat/Reader after opening documents.
- If your organization has endpoint logging, review alerts involving document opening activity on systems still running affected versions.
CISA KEV note
- This CVE is not listed in the CISA KEV set (per the findings), so don’t rely on KEV status alone—patch based on version exposure.

Technical context

Severity is high (CVSS 8.8) and the weakness is CWE-416 (use-after-free). The attack vector is remote via opening a crafted file (user interaction is required), and exploitation can result in arbitrary code execution with impact to confidentiality, integrity, and availability. Weaponization status: public exploit code is available (1 known). KEV status: not listed in CISA KEV. EPSS is predicted at 10.2% with a flat trend, but this should not be treated as confirmation of active exploitation; weaponized/public exploit availability is the more actionable indicator here. Patch information is available via Adobe’s APSB19-18 advisory.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

Adobe Systems Inc.commercial · USaka Adobe
- Adobe Acrobat Reader Document CloudDesktop AppConsumer Software / productivity
- Adobe Acrobat Document CloudDesktop AppOn-premConsumer Software / productivity

And 5 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable