CVE-2024-30312: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2024-30312 is an out-of-bounds read vulnerability affecting Adobe Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier. The vulnerability exists in the Font functionality of Adobe Acrobat Reader, specifically in the CPAL (Color Palette Table) handling. When exploited, this vulnerability could lead to disclosure of sensitive memory and potentially allow attackers to bypass security mitigations such as ASLR. The vulnerability requires user interaction, as a victim must open a malicious PDF file (Talos Report, NVD).

The vulnerability is related to the OpenType font format's CPAL table processing. The issue occurs when the value of max(colorRecordIndices) + numPaletteEntries is greater than numColorRecords, leading to an out-of-bounds read condition. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required with user interaction (Talos Report).

The successful exploitation of this vulnerability can lead to the disclosure of sensitive memory information. This information disclosure could potentially be leveraged by attackers to bypass security mitigations such as Address Space Layout Randomization (ASLR). The impact is limited to information disclosure without direct code execution capabilities (NVD, FortiGuard).

The vulnerability requires user interaction to be exploited, specifically requiring a victim to open a maliciously crafted PDF file containing specially crafted font data. The vulnerability is related to TALOS-2023-1905, as it wasn't properly patched to cover all cases in previous updates (Talos Report).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest versions of Adobe Acrobat and Reader. The fix is available through Adobe's security bulletin APSB24-29 (Adobe Advisory).