Adobe Acrobat and Reader Out-of-Bounds Read Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing out-of-bounds read has been identified in Adobe Acrobat and Reader. This issue affects versions through 25.001.20982, as well as specific earlier versions of Acrobat 2024 and Acrobat 2020. The vulnerability arises when the applications parse crafted files, leading to a read past the end of an allocated memory structure. An attacker could exploit this vulnerability to execute code in the context of the current user, but exploitation requires user interaction, as the victim must open a malicious file.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the user.

Remediation

Users are advised to update to the latest versions of Adobe Acrobat or Reader. The latest versions can be downloaded from the Adobe website or via the Adobe Update mechanism. For IT administrators, updates can be deployed using preferred methods such as SCCM or Apple Remote Desktop.