Miniaudio and Adobe Acrobat Reader vulnerabilities
Summary: Cisco Talos disclosed four vulnerabilities: an out-of-bounds write in the Miniaudio C audio library (CVE-2024-41147) triggered by a crafted FLAC file during playback, and three Adobe Acrobat font-functionality flaws - two out-of-bounds reads (CVE-2025-27163, CVE-2025-27164) and an uninitialized-pointer memory corruption issue (CVE-2025-27158) that can potentially lead to arbitrary code execution. The Adobe flaws are triggered by a specially crafted font file embedded in a PDF, and an attacker must trick the user into opening the malicious file; all four have been patched by their vendors.
Key Takeaway: The Acrobat uninitialized-pointer flaw can potentially reach arbitrary code execution from a font embedded in a PDF, so the only barrier left is whether a user opens the file - and the Miniaudio overflow needs nothing more than playing a crafted FLAC.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-41147CVE-2025-27158CVE-2025-27163CVE-2025-27164
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026