CVE-2022-34227

Adobe Acrobat Reader DC AcroForm value Use-After-Free Remote Code Execution Vulnerability

Description

Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Scores

Weaknesses (CWE)

• CWE-416

European references

• ENISA EUVD · EUVD-2022-37196
• GCVE · GCVE-0-2022-34227

CERT-FR advisories

• CERTFR-2022-AVI-676 — Multiples vulnérabilités dans Adobe Acrobat et Reader · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 22.001.20142
• cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 22.001.20142
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30005 ≤ 20.005.30334
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.30005 ≤ 20.005.30334
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30005 ≤ 20.005.30331
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.30005 ≤ 20.005.30331
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.012.30229
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.012.30229
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.012.30227
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.012.30227

Affected products

References

• https://helpx.adobe.com/security/products/acrobat/apsb22-32.html

Sources