CVE-2019-8017: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier…

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

13.33%

96.0th percentile

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	acrobat_reader_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_reader_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_reader_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	adobe_acrobat_and_reader	—	—

Detection & IOCsextracted from sources · hover to see the quote

processAcrobat.exe↗

command/FDArray 0↗

→Trigger path: open a PDF with an embedded Type 1 font containing '/FDArray 0' and export to PostScript (File > Export To > (Encapsulated) PostScript). Monitor CoolType.dll for access violations at call-through-uninitialized-pointer patterns. ↗
→Crash signature: access violation in CoolType.dll at CTGetVersion+0xafccf executing 'call dword ptr [ecx+0Ch]' where ecx=0xc0c0c0c0 (uninitialized heap memory). Alert on Acrobat.exe crashing inside CoolType!CTGetVersion with ecx pointing to uninitialized/patterned memory. ↗
→Heap spray/grooming indicator: exploitation relies on controlling freed heap chunks reused by malloc() so that uninitialized aux.stm pointer is populated with attacker-controlled data. Look for unusual heap allocation patterns preceding PDF font parsing in Acrobat.exe. ↗
→Vulnerable DLLs to monitor: CoolType.dll, acrodistdll.dll, Acrobat.dll, AdobePDFL.dll — all contain embedded AFDKO copies reachable via PDF font processing. ↗
→Uninitialized memory marker 0xbebebebebebebebe in aux struct (Linux AddressSanitizer build) and 0xc0c0c0c0 (Windows PageHeap) are indicators of the uninitialized FDArray[0].aux dereference during t1rIterateGlyphs/readGlyph execution. ↗

·The vulnerable AFDKO code path in CoolType.dll is only reachable when exporting a PDF with an embedded Type 1 font to PostScript or Encapsulated PostScript; simply opening the PDF does not trigger the vulnerability. ↗
·CoolType's AFDKO fork (cfr version 2.0.44) is at least ~5 years older than the open-source branch and contains non-public bounds-check fixes not present upstream; the open-source AFDKO on GitHub may be separately vulnerable via the same /FDArray 0 primitive. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.