CVE-2007-0048

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 33.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-03 · updated 2026-06-16

Description

Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when used with Internet Explorer, Google Chrome, or Opera, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL, related to a "cross-site scripting issue."

Affected products

Adobe Acrobat for Edge: through 7.0.8; 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 (+3)
Adobe Acrobat 3D: all versions
Adobe Acrobat Reader: through 7.0.8; 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5 (+9)

References

http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
http://osvdb.org/31596
http://secunia.com/advisories/23812
http://secunia.com/advisories/23882
http://secunia.com/advisories/33754
http://security.gentoo.org/glsa/glsa-200701-16.xml
http://securityreason.com/securityalert/2090
http://securitytracker.com/id?1017469
http://securitytracker.com/id?1023007
http://www.adobe.com/support/security/bulletins/apsb07-01.html

Get alerted when CVE-2007-0048 or the next vulnerability affects your stack