CVE-2022-28232

Deeper analysis

Acrobat Reader DC versions 22.001.20085 and earlier, 20.005.3031x and earlier, and 17.012.30205 and earlier contain a use-after-free vulnerability (CWE-416) in the processing of the collab object. The flaw can be triggered when the application handles specially crafted PDF content, resulting in arbitrary code execution in the context of the current user. The issue carries a CVSS 3.0 base score of 7.8 reflecting local attack vector, low attack complexity, no privileges required, and required user interaction.

An attacker can exploit the vulnerability by supplying a malicious file that a victim must open. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the logged-in user, potentially leading to full control over confidentiality, integrity, and availability of the affected system.

Adobe’s advisory APSB22-16 addresses the issue and directs users to apply the updates released for the affected Acrobat Reader DC tracks. The advisory lists the fixed versions and recommends installing the latest security patches through the product’s update mechanism or via direct download from Adobe.

The EPSS score for this CVE has remained flat at 0.1154 with no material increase after disclosure.