Technical intelligence and weaponization dossier for CVE-2013-3346. Documented exploitation across 1 active malware families totaling 35 analyzed telemetry samples.
| Vulnerability ID | CVE-2013-3346 |
|---|---|
| Common Name / Bulletin | Adobe Reader ToolButton Use-After-Free Memory Corruption (APSB13-15) |
| CWE Classification | CWE-416: Use After Free in AcroForm JavaScript |
| Affected Software & Versions | Adobe Reader 9.5.4, 10.1.6, 11.0.02 and earlier |
| Technical Root Cause | Use-after-free vulnerability in the ToolButton object in AcroForm JavaScript engine inside Adobe Reader, weaponized in targeted espionage by Turla. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| turla | Advanced Threat | 35 | Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cybe... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2013-3346 in enterprise networks:
PDF documents embedding JavaScript containing app.newDoc() or app.addToolButton() followed by memory spray arrays.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →