Untrusted Pointer Dereference in Adobe Reader and Adobe Acrobat - CVE-2019-16460

Vulnerability identifier: #VU23526

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16460

CWE-ID: CWE-822

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Adobe Reader
Adobe Acrobat

Install updates from vendor's website.

Adobe Reader - addressed in versions 15.006.30508, 17.011.30156, 19.021.20058
Adobe Acrobat - addressed in versions 15.006.30508, 17.011.30156, 19.021.20058

• https://helpx.adobe.com/security/products/acrobat/apsb19-55.html

• Multiple vulnerabilities in Adobe Acrobat and Reader