cyfenced.com →

[ CVE-2008-2992 · Published 4 Nov 2008 ]

Adobe Reader and Acrobat Input Validation Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
  • Known to be used in ransomware campaigns
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

CISA: Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

[ References ]References