Talos discovers 11 vulnerabilities between Microsoft, Adobe software disclosed on Patch Tuesday
Summary: Cisco Talos disclosed 11 vulnerabilities it discovered in Microsoft Windows CLIPSP.SYS and Adobe Acrobat Reader as part of this week's Patch Tuesday updates. Eight affect the license update feature in the CLIPSP.SYS driver on Windows 10 and 11, and three are use-after-free or out-of-bounds read flaws in Adobe Acrobat Reader's CoolType font processor, including one rated CVSS 8.8 that could allow arbitrary code execution.
What's compelling: The most serious Adobe flaw, CVE-2024-41830 at CVSS 8.8, triggers when a user opens a crafted PDF, and the CLIPSP.SYS issues include two out-of-bounds writes that could lead to privilege escalation and play into a sandbox escape.