CVE-2022-42342: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
First published: Fri Oct 14 2022(Updated: )
Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | >=15.008.20082<22.003.20258 | |
| Adobe Acrobat Reader Notification Manager | >=15.008.20082<22.003.20258 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | >=20.001.30005<20.005.30407 | |
| Adobe Acrobat Reader Notification Manager | >=20.001.30005<20.005.30407 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-42342?
CVE-2022-42342 is considered a high-severity vulnerability due to its potential to disclose sensitive memory and bypass security mitigations.
How do I fix CVE-2022-42342?
To mitigate CVE-2022-42342, update Adobe Acrobat Reader to version 22.003.20258 or later, or version 20.005.30407 or later.
What versions of Adobe Acrobat are affected by CVE-2022-42342?
CVE-2022-42342 affects Adobe Acrobat Reader versions 22.002.20212 and earlier, and 20.005.30381 and earlier.
Can CVE-2022-42342 be exploited remotely?
Yes, CVE-2022-42342 can be exploited remotely by an attacker to disclose sensitive information.
What platforms are impacted by CVE-2022-42342?
CVE-2022-42342 impacts Adobe Acrobat and Adobe Acrobat Reader on supported versions for various operating systems.
- agent/type
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/severity
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/15.008.20082
- canonical/adobe acrobat reader notification manager
- version/adobe acrobat reader notification manager/15.008.20082
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader notification manager/20.001.30005