CVE-2022-28230

Deeper analysis

Acrobat Reader DC versions 22.001.20085 and earlier, 20.005.3031x and earlier, and 17.012.30205 and earlier contain a use-after-free vulnerability (CWE-416) in the handling of acroform events. The flaw can be triggered during processing of specially crafted PDF content and may allow arbitrary code execution in the context of the current user. The issue carries a CVSS 3.0 base score of 7.8 with an attack vector of local access, low attack complexity, no privileges required, and required user interaction.

An attacker can exploit the condition by supplying a malicious file that the victim must open in an affected Acrobat Reader DC installation. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the logged-in user, potentially leading to full compromise of confidentiality, integrity, and availability on the target system.

Adobe has published security advisory APSB22-16 that addresses the vulnerability and directs users to apply the available updates for the affected Acrobat Reader DC releases. The EPSS score for this CVE has remained flat at a peak and current value of 0.1154 with no material increase observed after disclosure.