CVE-2022-28249: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader DC was found to contain an out-of-bounds read vulnerability in the handling of Annotation objects. The vulnerability, identified as CVE-2022-28249, affects multiple versions including 22.001.2011x (and earlier), 20.005.3033x (and earlier), and 17.012.3022x (and earlier). This security flaw was discovered and reported by researchers Krishnakant Patil and Ashfaq Ansari from HackSys Inc (ZDI Advisory).

The vulnerability exists within the handling of Annotation objects in Adobe Acrobat Reader DC. When specific actions are performed in JavaScript, an attacker can trigger a read past the end of an allocated object. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a relatively low severity but still requiring attention (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. The flaw could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Adobe has released a security update to address this vulnerability. Users are advised to apply the security update detailed in Adobe Security Bulletin APSB22-16 (Adobe Security).