CVE-2021-45060: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2021-45060 is an out-of-bounds read vulnerability affecting Adobe Acrobat Reader DC versions 21.007.20099 (and earlier), 20.004.30017 (and earlier), and 17.011.30204 (and earlier). The vulnerability was discovered in December 2021 and publicly disclosed on January 13, 2022 (ZDI Advisory, NVD).

The vulnerability exists within the processing of embedded fonts in PDF documents, specifically during TTF font parsing. The flaw stems from improper validation of user-supplied data, which can result in a read past the end of an allocated memory buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The impact is considered high as it could potentially lead to complete compromise of the affected system's confidentiality, integrity, and availability (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader DC through the official Adobe security bulletin (Adobe Advisory).