CVE-2019-8045

published 2019-08-20

CVE-2019-8045: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	acrobat_reader_dc	>= 15.006.30060 < 15.006.30499	15.006.30499
adobe	acrobat_reader_dc	>= 15.008.20082 < 19.012.20036	19.012.20036
adobe	acrobat_reader_dc	>= 17.011.30059 < 17.011.30144	17.011.30144
adobe	adobe_acrobat_and_reader	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47278.zip↗

• → Crash triggered by a malformed PDF with a corrupted JBIG2Globals stream object; a single byte at offset 0x3bc within the JBIG2Globals object is mutated (0x00 → 0xB5 in poc1.pdf, 0x00 → 0x35 in poc2.pdf), causing free() to be called on an uninitialized heap pointer. ↗
• → Exploit manifests as an access violation (code c0000005) in AcroRd32 during free() of an uninitialized pointer filled with PageHeap marker bytes (0xc0c0c0c0); look for AcroRd32 crashes with eax/ecx/edx containing 0xc0c0c0xx values in crash telemetry. ↗
• → Call stack shows free() called with pointer value 0xc0c0c0c0 (uninitialized heap memory) originating from AcroRd32!AX_PDXlateToHostEx and CTJPEGDecoderRelease; monitor for AcroRd32 process crashes in these code paths when processing PDF files containing JBIG2Globals streams. ↗
• → The crash occurs immediately upon opening the malicious PDF; endpoint detection should flag AcroRd32.exe crashing (access violation c0000005) immediately after PDF open events, particularly for PDFs containing JBIG2Globals stream objects. ↗

• · Crash reproduces most consistently with Windows PageHeap (Application Verifier) enabled; without PageHeap the uninitialized pointer value will differ from 0xc0c0c0c0 and the crash may be less deterministic. ↗
• · Affected versions span multiple Adobe Acrobat/Reader tracks (2015, 2017, 2019); the PoC was confirmed on version 2019.012.20035 on Windows 10. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119 CWE-476