CVE-2016-1090

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-4106.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-109006.1The uji-countdown plugin before 2.0.7 for WordPress has XSS.CVE-2016-109016.1The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.CVE-2016-109028.8The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-109038.8The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.CVE-2016-109049.8The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-109057.8An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and r CVE-2016-109067.0An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race conditi CVE-2016-109077.8An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755 CVE-2016-109086.1The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-109099.8The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10919.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acro CVE-2016-109106.1The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.