Asus and Adobe vulnerabilities

Summary: Cisco Talos disclosed two vulnerabilities each in Asus Armoury Crate 5.9.13.0 and Adobe Acrobat Reader 2025.001.20435, all since patched by the vendors. The Asus flaws are a stack-based buffer overflow in the AsIO3.sys kernel driver (CVE-2025-1533) triggerable by an unprivileged attacker via a crafted I/O request packet, and an authorization bypass (CVE-2025-3464) triggered by a crafted hard link; the Adobe flaws are an out-of-bounds read in font handling (CVE-2025-43578) that can disclose sensitive information and a use-after-free in annotation processing (CVE-2025-43576) that can lead to arbitrary code execution.
What's compelling: The Asus kernel driver flaw lets an unprivileged user trigger a buffer overflow from user mode, and the Adobe use-after-free can reach arbitrary code execution if a user simply opens a malicious PDF - both patched, but only for organizations that actually apply the updates.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-1533 CVE-2025-3464 CVE-2025-43576 CVE-2025-43578
Related: ⚡ Weekly Recap: Airline Hacks, Citrix 0-Day, Outlook Malware, Banking Trojans and more Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026