CVSS 9.3 CRITICAL Bulletin: APSB10-07 Published: 2010-02-16

CVE-2010-0188: Adobe Acrobat & Reader TIFF Integer Overflow Remote Code Execution

Technical intelligence and weaponization dossier for CVE-2010-0188. Documented exploitation across 2 active malware families totaling 93 analyzed telemetry samples.

Attributed Families

Sample Volume

CVSS Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2010-0188
Common Name / Bulletin	Adobe Acrobat & Reader TIFF Integer Overflow Remote Code Execution (`APSB10-07`)
CWE Classification	`CWE-189: Numeric Errors / Integer Overflow`
Affected Software & Versions	Adobe Reader 9.3 and earlier, Acrobat 9.3 and earlier
Technical Root Cause	Integer overflow in CoolType.dll when processing embedded TIFF images within PDF files, leading to arbitrary heap memory corruption and sandbox escape.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.001` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2010-0188

Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

2 families

Malware Family	Category	Catalog Samples	Operational Profile
cutwail	Botnet	`92`	Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam...
darkhotel	Backdoor	`1`	Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly reveale...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2010-0188 in enterprise intrusions and campaign toolkits:

Darkhotel APT Group — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2010-0188 in enterprise networks:

AcroRd32.exe crashing with access violation in CoolType.dll followed by creation of drop files in C:\Users\Public\ or %TEMP%.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Update to supported versions of Adobe Acrobat DC with Protected Mode enabled; enforce PDF attachment sanitization at email perimeter.

For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →

← Return to Vulnerability Matrix Directory (All 63 CVEs)