CVE-2022-24092: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader DC was found to contain an out-of-bounds write vulnerability that could lead to remote code execution. The vulnerability, identified as CVE-2022-24092, affects multiple versions of Adobe Acrobat Reader DC including versions 21.001.20155 and earlier, 20.004.30017 and earlier, and 17.011.30204 and earlier. The vulnerability was discovered and reported to Adobe on December 15, 2021, with public disclosure occurring on March 18, 2022 (ZDI Advisory).

The vulnerability exists within the parsing of embedded fonts in Adobe Acrobat Reader DC. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 7.8 with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The vulnerability requires user interaction, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader DC through the official Adobe security bulletin (Adobe Security).