What is CVE-2010-3654?

CVE-2010-3654 is a vulnerability in Adobe Acrobat, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2010-10-29.

Is CVE-2010-3654 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Adobe Acrobat

CVE-2010-3654

Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.

Vulnerability class: Buffer Overflow

Published 2010-10-29 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.697 (99.4th percentile), scored 2026-10-17.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.697 · newest: 0.697 · change: 0.000

Affected products

Adobe Acrobat — versions 9.1.2, 9.1.3, 9.0
Adobe Acrobat Reader — versions 9.1.2, 9.1.3, 9.0
Adobe Flash Player — versions 7.0.63, 7.2, 7.1.1
Apple Mac OS X
Google Android
Linux Kernel
Macromedia Flash Player — versions 6.0.47.0, 6.0.79.0, 5.0_r50
Microsoft Windows
Oracle Solaris

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

rapid7/metasploit-framework

References

www.vupen.com/english/advisories/2011/0192 (vdb-entry)
secunia.com/advisories/42183 (third-party-advisory)
contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html (Exploit)
support.apple.com/kb/HT4435
secunia.com/advisories/42030 (third-party-advisory)
www.vupen.com/english/advisories/2011/0191 (vdb-entry)
blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1
secunia.com/advisories/43025 (third-party-advisory)
www.vupen.com/english/advisories/2011/0344 (vdb-entry)
secunia.com/advisories/43026 (third-party-advisory)

Frequently asked questions

What is CVE-2010-3654?: CVE-2010-3654 is a vulnerability in Adobe Acrobat, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2010-10-29.
Is CVE-2010-3654 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.