CVE-2010-1240

EXPLOITED

Adobe PDF Embedded EXE Social Engineering

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2010-1240 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 9 public exploits from researchers including Metasploit, Didier Stevens, Jasmoon99, including a Metasploit module exploits/windows/fileformat/adobe_pdf_embedded_exe.

AI-analyzed exploit summary This Metasploit module exploits CVE-2010-1240 by embedding a malicious executable in a PDF file without requiring JavaScript. It uses hex encoding and obfuscation techniques to evade detection and executes the payload via a crafted /Launch action.

Description

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.

Exploits (9)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16682

This Metasploit module exploits CVE-2010-1240 by embedding a malicious executable in a PDF file without requiring JavaScript. It uses hex encoding and obfuscation techniques to evade detection and executes the payload via a crafted /Launch action.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader <= v9.3.3
No auth needed
Prerequisites: Target must open the malicious PDF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16671

This Metasploit module embeds a malicious payload into an existing PDF file, leveraging Adobe Reader's handling of embedded executables for social engineering attacks. It generates a weaponized PDF that, when opened, executes the embedded payload via JavaScript and command injection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader v8.x, v9.x (Windows XP SP3 English)
No auth needed
Prerequisites: Valid PDF file to embed payload · Metasploit Framework
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Didier Stevens · textlocalwindows
https://www.exploit-db.com/exploits/11987

This exploit leverages PDF's launch action feature to execute embedded executables without exploiting a vulnerability. It bypasses user warnings in Adobe Reader and executes without interaction in Foxit Reader.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Adobe Reader 9.3.1, Foxit Reader
No auth needed
Prerequisites: User opens the malicious PDF file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 69 stars
by Jasmoon99 · poc
https://github.com/Jasmoon99/Embedded-PDF

This repository provides a detailed technical walkthrough of exploiting CVE-2010-1240, a vulnerability in Adobe Reader <= 8.1.2, using Metasploit's `adobe_pdf_embedded_exe` module to achieve remote code execution via a malicious PDF file. It includes step-by-step instructions for generating the payload, setting up a listener, and demonstrating post-exploitation activities.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader <= 8.1.2
No auth needed
Prerequisites: Metasploit framework · Kali Linux · Adobe Reader <= 8.1.2 on target · Network connectivity for reverse TCP
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 7 stars
by omarothmann · poc
https://github.com/omarothmann/Embedded-Backdoor-Connection

This repository provides a detailed guide on exploiting CVE-2010-1240 using Metasploit to embed a malicious payload in a PDF file, which executes arbitrary code via reverse TCP when opened in vulnerable Adobe Reader versions.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader <= 8.1.2
No auth needed
Prerequisites: Metasploit framework · Vulnerable Adobe Reader version · Network connectivity for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by asepsaepdin · poc
https://github.com/asepsaepdin/CVE-2010-1240

This repository provides a functional exploit for CVE-2010-1240, leveraging Metasploit's `adobe_pdf_embedded_exe` module to embed a malicious executable in a PDF. The exploit tricks users into executing arbitrary local programs via a deceptive dialog box, demonstrating a social engineering attack vector.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader and Acrobat 9.x before 9.3.3, 8.x before 8.2.3
No auth needed
Prerequisites: Metasploit Framework · Victim interaction to open the malicious PDF
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by 12345qwert123456 · client-side
https://github.com/12345qwert123456/CVE-2010-1240

This repository contains a functional Python script that generates malicious PDFs exploiting CVE-2010-1240, a vulnerability in Adobe Reader/Acrobat allowing arbitrary code execution via Launch Actions. The tool demonstrates the exploit with configurable PowerShell payloads and includes detailed technical documentation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader/Acrobat < 9.3.3, < 8.2.3
No auth needed
Prerequisites: Vulnerable version of Adobe Reader/Acrobat · User interaction to open the PDF and bypass security warnings
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe.rb

This Metasploit module exploits CVE-2010-1240 by embedding a malicious executable into a PDF file, leveraging social engineering to trick users into executing the payload. It targets Adobe Reader vulnerabilities to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader v8.x, v9.x
No auth needed
Prerequisites: A valid PDF template file · User interaction to open the malicious PDF
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe_nojs.rb

This Metasploit module embeds a payload EXE into a PDF file using HEX encoding and leverages a social engineering technique to execute the payload without requiring JavaScript. It exploits CVE-2010-1240 by embedding a command in the PDF that launches a VBScript to decode and execute the payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Adobe Reader <= v9.3.3
No auth needed
Prerequisites: Target must open the malicious PDF file · Target must have a vulnerable version of Adobe Reader
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1636
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA10-231A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024159
Various Sources mailing-list x_refsource_mlist
http://lists.immunitysec.com/pipermail/dailydave/2010-April/006075.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7466

Scores

EPSS 0.9140
EPSS Percentile 99.7%

Details

VulnCheck KEV 2016-05-16
CWE
CWE-264
Status published
Products (1)
adobe/acrobat_reader 9.3.1
Published Apr 05, 2010
Tracked Since Feb 18, 2026