CVE-2024-30311: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2024-30311 is an out-of-bounds read vulnerability affecting Adobe Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier. The vulnerability was discovered in May 2024 and affects both Windows and macOS operating systems (NVD, Adobe Advisory).

The vulnerability exists in the Font functionality of Adobe Acrobat Reader, specifically in the handling of OpenType font files embedded in PDFs. It occurs when processing the glyph variations (gvar) table, where an out-of-bounds read condition can be triggered due to improper validation of buffer sizes. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (Talos, NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive memory information and potentially allow attackers to bypass security mitigations such as ASLR (Address Space Layout Randomization). The vulnerability requires user interaction, as victims must open a malicious PDF file for the exploit to be triggered (NVD).

The vulnerability requires user interaction to be exploited, as a victim must open a specially crafted malicious PDF file. The attack requires local access with no privileges, but needs user interaction to succeed (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest versions of Adobe Acrobat and Reader (Adobe Advisory).