Vulnerability DatabaseCVE-2024-34122

CVE-2024-34122:
vulnerability analysis and mitigation

Overview

Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. The vulnerability was discovered and disclosed by Adobe Systems Incorporated, with the CVE being assigned on July 2, 2024 (NVD).

Technical details

The vulnerability is classified as an out-of-bounds read (CWE-125) issue that occurs when parsing a crafted file, which could result in a read past the end of an allocated memory structure. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

Impact

An attacker could leverage this vulnerability to execute code in the context of the current user. The vulnerability affects confidentiality, integrity, and availability of the system, as indicated by the high impact scores in the CVSS rating (NVD).

Exploitability

Exploitation of this issue requires user interaction in that a victim must open a malicious file. The attack complexity is considered low, but requires local access (NVD).

Mitigation and workarounds

Microsoft has released patches to address this vulnerability. Users should update their Acrobat for Edge to versions newer than 126.0.2592.68 (Microsoft Advisory).