CVE-2024-30311: TALOS-2024-1946 - Adobe Acrobat Reader Font gvar GlyphVariationData out-of-bounds read vulnerability
First published: Wed May 15 2024(Updated: )
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Adobe Acrobat | >=15.007.20033<24.002.20759 | |
| Adobe Acrobat Reader | >=15.007.20033<24.002.20759 | |
| Any of | ||
| Apple macOS | ||
| Microsoft Windows | ||
| All of | ||
| Any of | ||
| Adobe Acrobat Reader | >=20.001.30002<20.005.30635 | |
| Adobe Acrobat Reader | >=20.001.30002<20.005.30635 | |
| Apple macOS | ||
| All of | ||
| Any of | ||
| Adobe Acrobat Reader | >=20.001.30002<20.005.30636 | |
| Adobe Acrobat Reader | >=20.001.30002<20.005.30636 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-30311?
CVE-2024-30311 is classified as a high severity vulnerability due to its potential to disclose sensitive memory.
How do I fix CVE-2024-30311?
To mitigate CVE-2024-30311, update Adobe Acrobat and Adobe Acrobat Reader to the latest versions that address this vulnerability.
Which versions of Adobe Acrobat are affected by CVE-2024-30311?
CVE-2024-30311 affects Adobe Acrobat versions 20.005.30574, 24.002.20736 and earlier.
Can CVE-2024-30311 be exploited remotely?
Yes, CVE-2024-30311 can potentially be exploited remotely by an attacker to bypass memory mitigations.
Does CVE-2024-30311 affect both Windows and macOS users?
CVE-2024-30311 specifically affects Adobe Acrobat products, but the vulnerability does not apply to macOS or Windows operating systems directly.
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat
- version/adobe acrobat/15.007.20033
- canonical/adobe acrobat reader
- version/adobe acrobat reader/15.007.20033
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows
- version/adobe acrobat reader/20.001.30002