Zero-Day Flaws in Adobe Reader, Acrobat
Summary: Adobe warned that attackers are exploiting two critical vulnerabilities in its PDF Reader and Acrobat software, affecting the latest versions including Reader and Acrobat XI (11.0.01 and earlier), X (10.1.5 and earlier), and 9.5.3 and earlier on Windows and Macintosh, plus Reader 9.5.3 on Linux. Adobe said the exploits are used in targeted attacks that trick Windows users into clicking a malicious PDF delivered by email, and that the exploit evades the sandbox protection built into the products.
Why it matters: The sandbox Adobe relies on for protection is exactly what this exploit bypasses, and the affected versions include the latest releases, so an organization's current Reader install is the exposure. Adobe said a patch would be available the following week, leaving a window in which the only mitigations were enabling Protected View or switching readers.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2013-0640
- Related
- CVE-2013-0640: Adobe Reader and Acrobat Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026