CVE-2022-28261: Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, whic...

Summary

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	acrobat_dc	>= 15.008.20082, <= 22.001.20085 `cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*`
adobe	acrobat_reader_dc	>= 15.008.20082, <= 22.001.20085 `cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*`
adobe	acrobat	>= 17.011.30059, <= 17.012.30205 >= 20.001.30005, <= 20.005.30314 >= 20.001.30005, <= 20.005.30311 `cpe:2.3:a:adobe:acrobat:::::classic:::*`
adobe	acrobat_reader	>= 17.011.30059, <= 17.012.30205 >= 20.001.30005, <= 20.005.30314 >= 20.001.30005, <= 20.005.30311 `cpe:2.3:a:adobe:acrobat_reader:::::classic:::*`

Original advisory text

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, whic...

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

References

https://helpx.adobe.com/security/products/acrobat/apsb22-16.html Vendor Advisory