CVE-2025-43578: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2025-43578) affects Adobe Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier. The vulnerability exists in the Font CFF2 PrivateDict vsindex functionality and could lead to disclosure of sensitive memory. The issue was discovered in June 2025 and requires user interaction, specifically opening a malicious file, to be exploited (CVE Details, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) and has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability occurs when processing the vsindex PrivateDICT operator, specifically when the value of ivd is greater than or equal to itemVariationDataCount (Talos Report).

The vulnerability could lead to disclosure of sensitive memory information and could potentially be leveraged by attackers to bypass security mitigations such as ASLR (Address Space Layout Randomization). The impact is limited to confidentiality, with no direct effect on system integrity or availability (NVD).

Adobe has addressed this vulnerability in their security update. Users should update to the latest version of Adobe Acrobat Reader. As a general security practice, users should be cautious when opening PDF files from untrusted sources (Adobe Security).