CVE-2022-28243: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2022-28243 is an out-of-bounds read vulnerability affecting Adobe Acrobat and Reader DC for Windows and macOS. The vulnerability was discovered in March 2022 and publicly disclosed on April 28, 2022. The issue specifically affects the handling of Doc objects within Adobe Acrobat Reader DC (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data when handling Doc objects, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating its critical severity. The flaw requires user interaction for exploitation, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory, Adobe Security).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current process, memory leak, security feature bypass, and privilege escalation (Rapid7).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader DC (Adobe Security).