CVE-2025-43578: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2025-43578 is an out-of-bounds read vulnerability in Adobe Acrobat Reader's CFF2 font parsing functionality, specifically within the CoolType font rendering engine. It affects Acrobat Reader versions 25.001.20521 and earlier (Continuous track), 24.001.30235 and earlier (Classic 2024 track), and 20.005.30763 and earlier (Classic 2020 track). The vulnerability was published on June 10, 2025, with Cisco Talos credited for discovery and a detailed report published June 11, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, though Talos assigned a score of 6.5 using a network attack vector (Adobe Advisory, Talos Report).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-839 (Numeric Range Comparison Without Minimum Check). The vulnerability resides in the processing of CFF2 (Compact Font Format version 2) tables embedded in OpenType fonts within PDF files. Specifically, when parsing the PrivateDICT structure, the vsindex operator specifies an index (ivd) into the ItemVariationData array of the VariationStore; the code fails to validate that ivd is less than itemVariationDataCount, allowing an out-of-bounds read when a maliciously crafted font sets ivd to a value equal to or greater than the count. This causes the CoolType engine to use an attacker-controlled negative offset (e.g., 0xfffffe5b) as an array index, resulting in a left-shift and pointer arithmetic that reads memory outside the allocated buffer. Exploitation requires a victim to open a specially crafted PDF containing the malicious embedded font (Talos Report).

Successful exploitation leads to disclosure of sensitive memory contents from the Acrobat Reader process, which an attacker can leverage to defeat Address Space Layout Randomization (ASLR) and other memory-safety mitigations. There is no direct integrity or availability impact (no code execution on its own), but the memory disclosure could serve as a stepping stone in a multi-stage exploit chain to achieve arbitrary code execution. The affected asset scope is limited to the local user's session, as the attack vector is local and requires user interaction (Adobe Advisory, Talos Report).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to convince a victim to open a malicious PDF file (Talos Report).

1. Craft malicious PDF: Create a PDF file containing an embedded OpenType font with a CFF2 table. In the CFF2 Top DICT, set the vstore operator to point to a VariationStore with itemVariationDataCount set to a small value (e.g., 1).
2. Manipulate PrivateDICT: In one of the FontDICT entries' PrivateDICT, set the vsindex operator's operand (ivd) to a value greater than or equal to itemVariationDataCount (e.g., a large positive integer), bypassing the missing minimum-check validation.
3. Deliver the file: Distribute the malicious PDF via phishing email, malicious website, or other social engineering vector to trick the victim into opening it with a vulnerable version of Adobe Acrobat Reader.
4. Trigger out-of-bounds read: When the victim opens the PDF, the CoolType engine processes the CFF2 table, computes an out-of-bounds negative index from the malformed vsindex, and reads memory outside the allocated ItemVariationData buffer.
5. Extract memory contents: The attacker, if able to observe the rendering output or crash behavior, can infer memory layout information (e.g., heap addresses) to defeat ASLR, enabling a subsequent stage of exploitation such as code execution via a separate vulnerability (Talos Report).

• File System: Suspicious PDF files received via email or downloaded from untrusted sources containing embedded OpenType fonts with CFF2 tables; unexpected temporary files created by Acrobat Reader in %TEMP% or /tmp during PDF rendering.
• Process: Adobe Acrobat Reader process (AcroRd32.exe or Acrobat.exe) crashing or generating access violation exceptions when opening a specific PDF; unusual memory access patterns logged by application crash reporters (e.g., Windows Error Reporting).
• Logs: Windows Event Log entries (Event ID 1000/1001) indicating Acrobat Reader application faults referencing CoolType.dll; crash dumps referencing CoolType!CTGetVersion at offsets consistent with the vulnerability (e.g., +0xc552b, +0xc9af5).
• Network: Unexpected outbound connections from Acrobat Reader to unknown external IPs shortly after opening a PDF (may indicate a chained exploit attempting post-exploitation communication) (Talos Report).

Adobe has released patched versions addressing CVE-2025-43578 via security advisory APSB25-57: update to Acrobat Reader/Acrobat DC (Continuous) version 25.001.20529 or later, Acrobat/Acrobat Reader (Classic 2024) version 24.001.30254 or later, and Acrobat/Acrobat Reader (Classic 2020) version 20.005.30774 or later. As interim mitigations, organizations should avoid opening PDF files from untrusted or unknown sources, and consider enabling Protected Mode/Protected View in Acrobat Reader settings to sandbox rendering. Applying application whitelisting and keeping Adobe Reader updated via automatic updates are recommended prioritized steps (Adobe Advisory).

Cisco Talos published a detailed technical write-up (TALOS-2025-2159) on June 11, 2025, providing an in-depth analysis of the CFF2 parsing flaw and debugger traces demonstrating the out-of-bounds read (Talos Report). Talos also published a broader blog post covering ASUS and Adobe vulnerabilities that included discussion of this CVE (Talos Blog). Zscaler noted protection coverage for this and related Adobe June 2025 vulnerabilities in their security advisories. The vulnerability was included in Sophos's June 2025 Patch Tuesday roundup coverage, which highlighted the broader Adobe advisory (Sophos News). General community reaction has been measured given the medium severity and lack of active exploitation.