CVE-2022-35672: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 22.001.20085 and earlier, 20.005.30314 and earlier, and 17.012.30205 and earlier were affected by an out-of-bounds read vulnerability when parsing crafted files. The vulnerability was discovered and reported on April 6, 2022, and was officially assigned CVE-2022-35672 on July 12, 2022 (CVE Details, ZDI Advisory).

The vulnerability exists within the parsing of embedded fonts in PDF files. When processing a specially crafted file containing malformed font data, the application can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (High), with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user's process. The impact is significant as Adobe Acrobat Reader is widely used for PDF document handling across various organizations (CVE Details).

Exploitation of this vulnerability requires user interaction, specifically requiring a victim to open a malicious file. The attack vector is considered local, with low attack complexity and no privileges required, though user interaction is necessary (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader. The fix was included in the security bulletin APSB22-16 (Adobe Security).