Part II: Returning to Adobe Reader symbols on macOS

Summary: Project Zero's Mateusz Jurczyk found that macOS Adobe Reader installers from versions 7.x through DC shipped debug symbols, with 8.x and 9.x releases carrying the most data, including private stabs-format symbols for the 3D module (7.x) and the CoolType font engine (most 9.x versions). In a 6.35 MB AdobeCoolType file from Reader 9.5.5, roughly 1.78 MB is consumed by debug strings, and the AGM component was not stripped in DC versions from 15.006.30033 (March 2015) to 15.016.20045 (June 2016).
What's compelling: The CoolType symbols expose source file paths, line numbers, local variable names and struct definitions for font rasterization code that is also shared by Windows kernel drivers (win32k.sys, atmfd.dll), DirectWrite, macOS font libraries and the JRE t2k rasterizer - giving anyone studying that attack surface a detailed map Adobe never intended to publish.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026