CVE-2022-28231: Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability
First published: Wed May 11 2022(Updated: )
Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by an out-of-bounds read vulnerability when processing a doc object, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat DC | >=15.008.20082<=22.001.20085 | |
| Adobe Acrobat DC | >=15.008.20082<=22.001.20085 | |
| Apple macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | >=17.011.30059<=17.012.30205 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.012.30205 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30314 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30314 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30311 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30311 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-28231?
CVE-2022-28231 has a high severity rating due to the potential for an out-of-bounds read vulnerability that may be exploited by attackers.
How do I fix CVE-2022-28231?
To fix CVE-2022-28231, update Adobe Acrobat Reader DC to version 22.001.20086 or later, or the appropriate version of Acrobat Reader for your setup.
Which versions of Adobe Acrobat are affected by CVE-2022-28231?
CVE-2022-28231 affects Adobe Acrobat Reader DC versions 22.001.20085 and earlier, 20.005.3031x and earlier, and 17.012.30205 and earlier.
What type of vulnerability is CVE-2022-28231?
CVE-2022-28231 is categorized as an out-of-bounds read vulnerability that occurs when processing a doc object.
Can CVE-2022-28231 be exploited remotely?
Yes, CVE-2022-28231 can potentially be exploited remotely by an attacker to read past the end of an allocated memory structure.
- agent/type
- agent/author
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/severity
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat dc
- version/adobe acrobat dc/15.008.20082
- version/adobe acrobat dc/22.001.20085
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe acrobat reader
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.012.30205
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.005.30314
- version/adobe acrobat reader/20.005.30311