CVE-2024-20749: TALOS-2023-1910 - Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerability
Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe Acrobat Readerto a version that resolves this vulnerability.Fixed in 20.005.30539 - Upgrade
Upgrade
Adobe Acrobat Readerto a version that resolves this vulnerability.Fixed in 23.008.20470 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch TALOS-2023-1910
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20749?
CVE-2024-20749 is considered a high-severity vulnerability due to its potential to disclose sensitive memory.
How do I fix CVE-2024-20749?
To fix CVE-2024-20749, you should update Adobe Acrobat Reader DC or Adobe Acrobat to the latest version available.
Is my version of Acrobat affected by CVE-2024-20749?
Versions 20.005.30539, 23.008.20470 and earlier of Adobe Acrobat Reader and Adobe Acrobat are affected by CVE-2024-20749.
Can CVE-2024-20749 be exploited remotely?
Yes, an attacker could potentially exploit CVE-2024-20749 remotely to bypass security mitigations.
What platforms are affected by CVE-2024-20749?
CVE-2024-20749 affects Adobe Acrobat and Acrobat Reader on both Windows and macOS platforms.