CVE-2022-35678: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. This vulnerability was discovered in August 2022 and could potentially be used by attackers to bypass security mitigations such as ASLR (NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 5.5 (Medium). The attack requires local access and user interaction, as victims must open a malicious file to trigger the vulnerability (Lansweeper).

If successfully exploited, this vulnerability could result in the disclosure of sensitive memory information and potentially allow attackers to bypass Address Space Layout Randomization (ASLR), a crucial security feature that helps prevent certain types of memory exploitation attacks (NVD).

The vulnerability requires user interaction for successful exploitation, specifically requiring a victim to open a malicious file. The attack vector is local, meaning the attacker needs local access to the target system (NVD).

Adobe has released patches to address this vulnerability. Users should update their software to the following versions: Acrobat DC Continuous track to version 22.002.20191, Acrobat 2020 Classic track to version 20.005.30381, and Acrobat 2017 Classic track to version 17.012.30262 (Lansweeper).