CVE-2024-41832: TALOS-2024-2002 | Adobe Acrobat Reader Font gvar TupleVariation Data Out-Of-Bounds Read Vulnerability
First published: Wed Aug 14 2024(Updated: )
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Adobe Acrobat Reader | >=20.001.30005<20.005.30655 | |
| Adobe Acrobat Reader | >=24.001.20604<24.001.30159 | |
| Adobe Acrobat Reader | >=15.008.20082<24.002.21005 | |
| Adobe Acrobat Reader Notification Manager | >=20.001.3005<20.005.30655 | |
| Adobe Acrobat Reader Notification Manager | >=15.008.20082<24.002.21005 | |
| Any of | ||
| Apple iOS and macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-41832?
CVE-2024-41832 is classified as a high-severity vulnerability due to the potential disclosure of sensitive memory.
How do I fix CVE-2024-41832?
To fix CVE-2024-41832, update to the latest versions of Adobe Acrobat Reader and Acrobat DC.
What versions are affected by CVE-2024-41832?
CVE-2024-41832 affects Adobe Acrobat Reader versions 20.005.30636 and earlier as well as Acrobat DC versions 15.008.20082 through 24.002.21005.
What type of vulnerability is CVE-2024-41832?
CVE-2024-41832 is an out-of-bounds read vulnerability that can lead to memory disclosure.
Can CVE-2024-41832 be exploited to bypass security measures?
Yes, CVE-2024-41832 can be exploited to bypass mitigations such as Address Space Layout Randomization (ASLR).
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/24.001.20604
- version/adobe acrobat reader/15.008.20082
- canonical/adobe acrobat reader notification manager
- version/adobe acrobat reader notification manager/20.001.3005
- version/adobe acrobat reader notification manager/15.008.20082
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows