Vulnerability Spotlight: Another fix for Adobe Acrobat Reader DC text field value remote code execution

Summary: Cisco Talos disclosed a remote code execution vulnerability in Adobe Acrobat Reader DC version 2019.012.20035, where the software incorrectly counts array elements and a specific embedded JavaScript can cause heap corruption leading to arbitrary code execution. The flaw is the same code as previously disclosed TALOS-2018-0704 and TALOS-2019-0774, and Adobe's earlier patches did not cover all cases; the victim must open a malicious file or access a malicious web page to trigger it.
What's compelling: This is the third disclosure of the same underlying bug after two rounds of patches that missed cases, so a security leader should treat prior Acrobat fixes as incomplete and confirm the current update is applied rather than assuming an earlier patch closed the hole.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026