ZDI-26-660: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability

Adobe Acrobat Reader contains a use-after-free vulnerability (CWE-416) in its font-parsing code that can expose sensitive contents of process memory. An attacker triggers it by crafting a malicious file (e.g., a PDF with specially formed font data) that a victim must open, so exploitation requires user interaction. Successful exploitation results in disclosure of sensitive information from memory, with no direct impact on data integrity or system availability, and the CVSS score of 5.5 (medium) reflects this read-only, local attack vector. Anyone running Adobe Acrobat Reader could be affected if they open an attacker-supplied file. As of now there is no known exploitation in the wild, no public proof-of-concept, and the EPSS probability of exploitation within 30 days is low at 0.2%; the flaw is also not in CISA's KEV catalog.

Do: Update Acrobat Reader to the latest release per Adobe's security bulletin, since the source data does not list specific fixed version numbers. Until patched, caution users against opening PDFs from untrusted sources and keep Reader's Protected Mode/Protected View enabled to limit memory-disclosure risk. Although no exploitation is currently known, font-parsing bugs in PDF readers are a common ingredient in exploit chains, so prioritize patching on endpoints that handle untrusted documents.