Vulnerability Spotlight: Adobe Acrobat Reader remote code execution
Summary: Cisco Talos discovered a remote code execution vulnerability in Adobe Acrobat Reader DC 2019.10.20069 that triggers when a user opens a malicious PDF or visits a malicious web page, where embedded JavaScript causes heap corruption that can lead to arbitrary code execution. Talos reported the flaw as TALOS-2018-0774/CVE-2019-7125, noting it is the same issue as TALOS-2018-0704/CVE-2018-19716 disclosed in December 2018 because the earlier fix did not cover all cases, and Adobe has released an update.
Key Takeaway: Acrobat is the most widely used PDF reader on the market, so the potential target base is large, and the JavaScript support that enables interactive forms gives an attacker a way to control memory layout. The same flaw was disclosed in December 2018 and not fully patched, which means a prior update left some users exposed.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-19716CVE-2019-7125
- Related
- Vulnerability Spotlight: Adobe Acrobat Reader DC text field remote code execution vulnerability Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026