← All detection heuristics · CVE
critical
CVE likely
CVE_2010_0188
What it means
PDF contains XFA JavaScript that heap-sprays shellcode, builds a TIFF image payload, and assigns it to an XFA image rawValue.
Why it fires
CVE-2010-0188 was widely exploited through XFA JavaScript that generated a malformed TIFF image and assigned it to an image field, causing Adobe Reader/Acrobat to parse the crafted TIFF through the vulnerable LibTIFF path. The rule decodes the common long-hex XFA wrapper and requires the TIFF payload marker, rawValue trigger, and heap-spray/version-selection logic, including split-string character-table wrappers seen in older kits. The finding matches the exploit template and does not claim structural validation of the embedded TIFF.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118 CVE_2009_0658