CVE-2019-8042
published 2019-08-20CVE-2019-8042: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
16.84%
96.7th percentile
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat_dc | >= 15.006.30060 < 15.006.30499 | 15.006.30499 |
| adobe | acrobat_dc | >= 15.008.20082 < 19.012.20036 | 19.012.20036 |
| adobe | acrobat_dc | >= 17.011.30059 < 17.011.30144 | 17.011.30144 |
| adobe | acrobat_reader_dc | >= 15.006.30060 < 15.006.30499 | 15.006.30499 |
| adobe | acrobat_reader_dc | >= 15.008.20082 < 19.012.20036 | 19.012.20036 |
| adobe | acrobat_reader_dc | >= 17.011.30059 < 17.011.30144 | 17.011.30144 |
| adobe | adobe_acrobat_and_reader | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x2bd4c: 0x00 => 0xff, 0x2bd4d: 0x00 => 0xff, 0x2d5b8: 0x00 => 0xff
- →Crash triggered immediately upon opening a malformed PDF containing a crafted TrueType font (TTF) stream; monitor AcroRd32/Acrobat for access violation (code c0000005) originating from CoolType.dll during PDF open events. ↗
- →Look for heap-based out-of-bounds write in CoolType.dll (CTInit function) triggered by a malformed TTF font embedded in a PDF; the write occurs at a large negative offset from the heap allocation base. ↗
- →Mutation of three specific bytes inside a TrueType font stream embedded in a PDF (offsets 0x2bd4c, 0x2bd4d, 0x2d5b8 changed from 0x00 to 0xff) is sufficient to trigger the vulnerability; YARA rules targeting 0xff bytes at these offsets within a TTF stream in PDF may aid detection. ↗
- →Affected version confirmed as Adobe Acrobat Reader DC 2019.012.20035 on Windows 10; presence of this version combined with PDF-triggered CoolType crash is a strong indicator of exploitation attempt. ↗
- ·A second, nearly identical crash was observed in version 2019.012.20040 (after the CVE-2019-8042 patch), suggesting an incomplete fix or variant; detections targeting only the patched version boundary may miss this follow-on issue. ↗
- ·The heap corruption is more cleanly observable with Windows PageHeap (gflags) enabled; without PageHeap the crash may be less deterministic and harder to reproduce in standard monitoring environments. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h69v-5f6h-mx35: Adobe Acrobat and Reader versions, 2019
ghsa_unreviewed·2022-05-24
CVE-2019-8042 [CRITICAL] CWE-787 GHSA-h69v-5f6h-mx35: Adobe Acrobat and Reader versions, 2019
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Project0
Part II: Returning to Adobe Reader symbols on macOS - Project Zero
project_zero·2020-01-01
CVE-2019-8042 Part II: Returning to Adobe Reader symbols on macOS - Project Zero
Posted by Mateusz Jurczyk, Project Zero
In a blog post titled "The story of Adobe Reader symbols" published in October 2019, I presented an analysis of the debug symbols shipped with some older versions of Adobe Reader for Unix-family systems released between 1997-2013. Such symbols can prove immensely useful for both understanding the inner workings of various Reader components while reverse engineering, and for automated tasks such as crash classification and deduplication in fuzzing projects. In that blog post, I only briefly mentioned the macOS Reader packages as containing up-to-date symbols for the JP2K and 3D components, but missing any other interesting information beyond that. Upon a closer and more thorough inspection of the Mac releases, I have discovered that in fact more deb
No detection rules found.
Exploit-DB
Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font
exploitdb·2019-12-11
CVE-2019-16451 Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font
Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font
---
We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file:
--- cut ---
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=707779e0 ebx=25876c38 ecx=052faab8 edx=707703a4 esi=707703d4 edi=25876e34
eip=10e6c29e esp=052fa89c ebp=052fa8a4 iopl=0 nv up ei pl nz ac po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210212
CoolType!CTInit+0x3913e:
10e6c29e 8902 mov dword ptr [edx],eax ds:002b:707703a4=31a03194
0:000> u @eip-14
CoolType!CTInit+0x3912a:
10e6c28a 8b7d0c mov edi,dword ptr [ebp+0Ch]
10e6c28d 8b571c mov edx,dword ptr [edi+1Ch]
10e6
Exploit-DB
Adobe Acrobat Reader DC for Windows - Heap-Based Memory Corruption due to Malformed TTF Font
exploitdb·2019-08-15
CVE-2019-8042 Adobe Acrobat Reader DC for Windows - Heap-Based Memory Corruption due to Malformed TTF Font
Adobe Acrobat Reader DC for Windows - Heap-Based Memory Corruption due to Malformed TTF Font
---
We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file:
--- cut ---
(4c84.1e3c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=13842768 ebx=14b6d730 ecx=1383e108 edx=13832820 esi=13832850 edi=14b6d92c
eip=1062a82e esp=1383def0 ebp=1383def8 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
CoolType!CTInit+0x37aa7:
1062a82e 8902 mov dword ptr [edx],eax ds:002b:13832820=????????
0:022> u @eip-14
CoolType!CTInit+0x37a93:
1062a81a 8b7d0c mov
2019-08-20
Published