Arbitrary code execution in Adobe Reader and Adobe Acrobat - CVE-2016-6993

Vulnerability identifier: #VU839

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6993

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated user to cause arbitrary code execution on the target system.
The weakness is due to use-after-free memory error. By tricking the victim to download a specially crafted file attackers can bypass security restrictions and trigger an arbitrary code to be executed.
Successful exploitatin of the vulnerability leads to arbitrary code execution on the vulnerable system.

Adobe Reader
Adobe Acrobat

Update Adobe Acrobat DC to version 15.020.20039.
Update Adobe Acrobat Reader DC to version 15.006.30243.
Update Adobe Reader IX and Adobe Acrobat IX to version 11.0.18

• https://helpx.adobe.com/security/products/acrobat/apsb16-33.html

• Multiple vulnerabilities in Adobe Acrobat and Reader