Vulnerability Spotlight: Adobe Acrobat Reader DC Document ID Remote Code Execution Vulnerability
Summary: Aleksandar Nikolic of Cisco Talos found that a JavaScript script embedded in a PDF can cause the Document ID field to be used in an unbounded copy operation, producing a stack-based buffer overflow in Adobe Acrobat Reader DC 2018.009.20044. When a PDF with an overly large Document ID field in the trailer is parsed and that field is referenced in JavaScript, encoding the bytes to a hex string can overflow the stack and overwrite the return address, allowing arbitrary code execution if the victim opens the malicious file or visits a malicious web page.
Why it matters: Exploitation requires only that a user open a crafted PDF or visit a malicious page in Acrobat Reader DC 2018.009.20044, so a single document opened by an unpatched reader is enough to hand an attacker code execution.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026