Out-of-bounds reads in Adobe Acrobat; Foxit PDF Reader contains vulnerability that could lead to SYSTEM-level privileges

Summary: Cisco Talos disclosed and helped patch more than 20 vulnerabilities over three weeks, including two out-of-bounds read flaws in Adobe Acrobat Reader's Font feature (CVE-2024-30311 and CVE-2024-30312) triggered when a user opens an attacker-created PDF with a specially embedded font, and a Foxit PDF Reader privilege escalation (CVE-2024-29072) caused by improper certification of the updater executable before execution. Talos also reported eight vulnerabilities in AutomationDirect's P3 line of PLC CPU modules, four of which scored 9.8 out of 10 on CVSS, with CISA issuing an advisory because the P3 line is commonly used in U.S. critical infrastructure and ICS networks.
Bottom line: Four of the AutomationDirect P3 flaws carry a CVSS score of 9.8, and CISA's advisory names commercial facilities, critical manufacturing and IT as sectors that could be affected - so the exposure sits in the PLCs running automated environments, not in a desktop application.

Read the original at Cisco Talos ↗