A heap-based buffer overflow in Adobe Acrobat Reader could allow an attacker to achieve arbitrary code execution on the host system.

This is a heap-based buffer overflow vulnerability. It requires user interaction, such as opening a maliciously crafted file, and affects authenticated users or local users depending on the environment.

A successful exploit allows an attacker to execute arbitrary code with the privileges of the user running Acrobat Reader. With a CVSS score of 7.8, this poses a high risk to endpoint security, potentially leading to malware installation, data theft, or lateral movement within the network.

Immediate Action: Apply the latest security updates provided by Adobe via the Creative Cloud desktop application or the official Adobe update portal.

Proactive Monitoring: Monitor endpoints for unusual process spawning behavior linked to the Acrobat Reader application.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to identify and block suspicious file executions originating from PDF documents.

Public Exploit Available: No

Given the prevalence of Adobe Acrobat Reader in corporate environments, this high-severity vulnerability must be addressed promptly. Administrators should enforce the latest patch version across all managed endpoints to mitigate the risk of arbitrary code execution.