CVE-2019-8016

published 2019-08-20

CVE-2019-8016: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	acrobat_reader_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_reader_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_reader_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	adobe_acrobat_and_reader	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Trigger vector: opening a PDF with an embedded font and exporting to PostScript (.ps) or Encapsulated PostScript (.eps) activates the vulnerable AFDKO code path inside CoolType.dll ↗
• → Vulnerable module is CoolType.dll inside Adobe Acrobat; monitor for anomalous memory operations or crashes originating from this DLL during PDF-to-PS/EPS export ↗
• → Exploit requires a crafted Type 1 font with a negative 'count' operand to the 'store' or 'load' CharString operators; look for Type 1 fonts embedded in PDFs where the store/load operator count argument is negative (i.e. >= 0x80000000 as a 32-bit float-encoded integer) ↗
• → Exploitation is limited to 32-bit (x86) builds of Adobe Acrobat for Windows; a controlled 32-bit index added to a memory pointer can address the entire process address space ↗
• → The out-of-bounds copy primitive targets both stack (h->BCA[] in t1cParse() stack frame) and heap (t1cAuxData structures); crash telemetry showing stack or heap corruption in CoolType.dll!t1cParse during PS/EPS export is a strong indicator ↗
• → Secondary NULL-pointer dereference risk: do_load() does not verify array != NULL before calling memcpy(); a crafted font with an out-of-range registry selector (not 0, 1, or 2) passed to the 'load' operator can trigger a NULL-source memcpy crash ↗

• · The vulnerable AFDKO fork in CoolType.dll is identified as 'cfr' module version 2.0.44, which predates the first open-sourced AFDKO commit (v2.0.46, September 2014); the forks in Acrobat.dll and AdobePDFL.dll are even older (cfr v2.0.31). Affected product versions span Acrobat/Reader 2015.006.30498 and earlier, 2017.011.30143 and earlier, and 2019.012.20035 and earlier. ↗
• · The memcpy_s() 'destsz' argument in CoolType's do_store() is incorrectly set to sizeof(pointer) (4 or 8 bytes) instead of the actual array size (16 or 64 bytes), making the safety-net ineffective for j>=2 and blocking legitimate access for j={0,1}; this mis-hardening does not prevent exploitation via the negative-count path ↗
• · It is uncertain whether the AFDKO copies in acrodistdll.dll and AdobePDFL.dll are reachable as an attack surface; only the CoolType.dll path (PDF open + PS/EPS export) is confirmed reachable ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787