Vulnerability in Acrobat Reader could lead to remote code execution; Microsoft patches information disclosure issue in Windows API
Summary: Cisco Talos disclosed two vulnerabilities that vendors have since fixed: a time-of-check, use-after-free flaw in Adobe Acrobat Reader (TALOS-2024-2011, CVE-2024-39420) that can trigger memory corruption and potentially arbitrary code execution when a user opens a specially crafted PDF with malicious JavaScript, and an information disclosure issue in the Microsoft Windows AllJoyn API (TALOS-2024-1980, CVE-2024-38257) that could let an adversary view uninitialized memory. Microsoft fixed the AllJoyn issue in its monthly security update on Tuesday, and the AllJoyn flaw is rated 'less likely' to be exploited though it requires no user interaction or privileges.
Bottom line: The Acrobat flaw needs only one user opening one malicious PDF to reach memory corruption and possible arbitrary code execution, and the AllJoyn bug needs no user interaction or privileges at all - a combination that puts a single document and an unpatched Windows endpoint on the same short path.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-38257CVE-2024-39420
- Related
- Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026