CVE-2019-8196: Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

22.89%

97.5th percentile

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat_dc	>= 15.006.30060 < 15.006.30504	15.006.30504
adobe	acrobat_dc	>= 15.008.20082 < 19.021.20047	19.021.20047
adobe	acrobat_dc	>= 17.011.30059 < 17.011.30150	17.011.30150
adobe	acrobat_reader_dc	>= 15.006.30060 < 15.006.30504	15.006.30504
adobe	acrobat_reader_dc	>= 15.008.20082 < 19.021.20047	19.021.20047
adobe	acrobat_reader_dc	>= 17.011.30059 < 17.011.30150	17.011.30150
adobe	adobe_acrobat_and_reader	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47610.zip↗

filenamepoc.pdf↗

bytes↗

0xFF, 0xFF, 0x0E at offsets 0x71a4, 0x71a5, 0x71ba in PDF (mutated CFF table bytes)

→Crash triggered in CoolType.dll (CTCleanup) when Adobe Acrobat Reader DC processes a malformed OTF font embedded in a PDF; look for access violations at eax=0xc0c0c0c0 (uninitialized heap pointer pattern) within CoolType!CTCleanup. ↗
→The vulnerability is triggered by a malformed CFF table inside an embedded OpenType font in a PDF. Specifically, a malformed CharString for the 'afii10091' glyph with an invalid cntrmask (0xFF 0xFF) and malformed hlineto operand causes the uninitialized pointer dereference. ↗
→The crash occurs immediately upon opening the PDF; monitor for AcroRd32.exe / Adobe Acrobat Reader DC crashing with access violation code 0xc0000005 in CoolType.dll shortly after document open events. ↗
→Affected versions: Adobe Acrobat Reader DC 2019.012.20036 and earlier (confirmed reproduction). Monitor for exploitation attempts against versions 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier. ↗

·Crash is most consistently reproduced with PageHeap enabled; without PageHeap the 0xc0c0c0c0 marker pattern may not be present, making heap-based detection signatures less reliable in production environments. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.