CVE-2024-39423: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2024-39423 is an out-of-bounds write vulnerability affecting Adobe Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier. The vulnerability was discovered by Mat Powell of Trend Micro Zero Day Initiative and was publicly disclosed on August 13, 2024. The affected systems include Adobe Acrobat and Reader for both Windows and macOS platforms (NVD, ZDI).

The vulnerability exists within the handling of Annotation objects in Adobe Acrobat Reader DC. The specific flaw stems from improper validation of user-supplied data, which can result in a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-787 (Out-of-bounds Write) (ZDI, NVD).

Successful exploitation of this vulnerability could result in arbitrary code execution in the context of the current user. The vulnerability could potentially lead to privilege escalation and memory leak when successfully exploited (Rapid7).

Exploitation of this vulnerability requires user interaction, specifically requiring a victim to open a malicious file. Adobe has acknowledged that there is a known proof-of-concept that could cause Adobe Acrobat and Reader to crash, however, they are not aware of this vulnerability being exploited in the wild (Rapid7).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader. The fix is available for both Windows and macOS operating systems (Adobe Advisory).