One font vulnerability to rule them all #2: Adobe Reader RCE exploitation
Summary: Google Project Zero's Mateusz Jurczyk published a second post in the "One font vulnerability to rule them all" series, showing how the ATMFD.DLL font interpreter's "blend" operator flaw could be exploited to achieve arbitrary code execution in Adobe Reader 11.0.10 on Windows 8.1 Update 1, both 32-bit and 64-bit. The exploit chains out-of-bounds stack writes using the sqrt and get instructions to build a ROP chain that calls VirtualProtectEx and marks attacker-controlled memory executable.
Key Takeaway: The proof of concept targeted the latest affected Adobe Reader build with all exploit mitigations enabled in user and kernel mode, and required only a PDF file to pop calc.exe - a reminder that a font parsing flaw in a shared interpreter can be a full remote code execution path.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026