CVE-2022-28258

published 2022-05-11

CVE-2022-28258: Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read…

medium 5.5 CVSS 3.1

AV L AC L PR N UI R S U C H I N A N

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	17.011.30059 – 17.012.30205	—
adobe	acrobat	20.001.30005 – 20.005.30314	—
adobe	acrobat	20.001.30005 – 20.005.30311	—
adobe	acrobat_dc	15.008.20082 – 22.001.20085	—
adobe	acrobat_reader	17.011.30059 – 17.012.30205	—
adobe	acrobat_reader	20.001.30005 – 20.005.30314	—
adobe	acrobat_reader	20.001.30005 – 20.005.30311	—
adobe	acrobat_reader	unspecified – 22.001.20085	—
adobe	acrobat_reader_dc	15.008.20082 – 22.001.20085	—

CWE-125