PT-2025-10872 · Adobe · Acrobat Reader

Kpc

·

Published

2025-01-22

·

Updated

2025-04-25

·

CVE-2025-27158

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat 2024 (affected versions not specified)
Description The issue is related to an access of uninitialized pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file. The vulnerability is associated with the use of an uninitialized pointer when processing the itemVariationDataCount field.
Recommendations For Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier: update to a version that fixes the access of uninitialized pointer vulnerability. For Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat 2024: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2025-02789
CVE-2025-27158

Affected Products

Acrobat Reader