CVE-2022-28235: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28235?
CVE-2022-28235 is classified as a critical severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2022-28235?
To mitigate CVE-2022-28235, update Adobe Acrobat Reader DC to version 22.001.20086 or later.
Which versions of Adobe Acrobat Reader DC are affected by CVE-2022-28235?
CVE-2022-28235 affects versions 22.001.20085 and earlier for Acrobat Reader DC, as well as versions 20.005.3031x and 17.012.30205 and earlier.
What types of systems are vulnerable to CVE-2022-28235?
CVE-2022-28235 impacts Adobe Acrobat Reader DC across different operating systems, including Windows and macOS.
What happens if CVE-2022-28235 is exploited?
Exploitation of CVE-2022-28235 could allow an attacker to execute arbitrary code with the privileges of the current user.