CVE-2022-34229

Deeper analysis

Adobe Acrobat Reader versions 22.001.20142 and earlier, 20.005.30334 and earlier, and 17.012.30229 and earlier contain a Use-After-Free vulnerability (CWE-416) that can lead to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 score of 7.8 and is triggered when the application processes specially crafted input.

An attacker can exploit the issue by supplying a malicious file that the victim must open; successful exploitation grants full control over the affected process without requiring elevated privileges beyond the user’s own context. The attack vector is local and the vulnerability is not remotely triggerable without user interaction.

Adobe’s security bulletin APSB22-32 addresses the issue and directs customers to apply the updates released in July 2022 for the affected Acrobat Reader tracks.

EPSS for the CVE rose from a low baseline at disclosure to a peak of 0.0749 on 2025-01-22 before receding to the current value of 0.0099, indicating a measurable increase in observed exploitation interest well after the original publication date.