CVE-2022-35667: Adobe Acrobat DC RCE Vulnerability

CVE-2022-35667 Overview

CVE-2022-35667 is an out-of-bounds write vulnerability affecting Adobe Acrobat Reader products across multiple versions. This memory corruption flaw could allow an attacker to achieve arbitrary code execution in the context of the current user. The vulnerability requires user interaction, as exploitation depends on convincing a victim to open a specially crafted malicious file.

Critical Impact

Successful exploitation enables arbitrary code execution with current user privileges, potentially leading to complete system compromise, data theft, or further malware deployment.

Affected Products

• Adobe Acrobat DC (Continuous) version 22.001.20169 and earlier
• Adobe Acrobat Reader DC (Continuous) version 22.001.20169 and earlier
• Adobe Acrobat (Classic 2020) version 20.005.30362 and earlier
• Adobe Acrobat Reader (Classic 2020) version 20.005.30362 and earlier
• Adobe Acrobat (Classic 2017) version 17.012.30249 and earlier
• Adobe Acrobat Reader (Classic 2017) version 17.012.30249 and earlier
• Affected on Microsoft Windows and Apple macOS platforms

Discovery Timeline

• August 11, 2022 - CVE-2022-35667 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-35667

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory corruption vulnerability that occurs when a program writes data outside the boundaries of an allocated memory buffer. In the context of Adobe Acrobat Reader, this flaw exists in the PDF parsing and rendering components.

The vulnerability requires local access through user interaction—specifically, a victim must open a malicious PDF document. Once triggered, the out-of-bounds write condition allows an attacker to corrupt adjacent memory regions, potentially overwriting critical data structures or code pointers. This memory corruption can be leveraged to achieve arbitrary code execution within the security context of the user running the application.

The local attack vector means that exploitation typically occurs through phishing campaigns, drive-by downloads, or malicious email attachments containing weaponized PDF files.

Root Cause

The root cause of CVE-2022-35667 lies in improper bounds checking within Adobe Acrobat Reader's memory handling routines. When processing certain malformed or specially crafted PDF content, the application fails to properly validate write operations, allowing data to be written beyond allocated buffer boundaries. This type of vulnerability often stems from incorrect size calculations, missing boundary validation, or improper handling of user-controlled input that influences memory allocation and write operations.

Attack Vector

The attack vector for CVE-2022-35667 follows a user interaction model typical of document-based exploits:

1. Initial Access: An attacker crafts a malicious PDF document containing specially designed content that triggers the out-of-bounds write condition
2. Delivery: The malicious PDF is delivered to the victim through phishing emails, malicious websites, or compromised file-sharing platforms
3. Execution: When the victim opens the malicious PDF in a vulnerable version of Adobe Acrobat Reader, the out-of-bounds write is triggered
4. Code Execution: The attacker leverages the memory corruption to gain arbitrary code execution with the privileges of the current user

The vulnerability does not require elevated privileges to exploit, and successful exploitation grants the attacker code execution capabilities that could be used for lateral movement, persistence establishment, or data exfiltration.

Detection Methods for CVE-2022-35667

Indicators of Compromise

• Suspicious PDF files with anomalous structure or embedded objects that trigger parsing errors
• Unexpected crashes or abnormal memory consumption in AcroRd32.exe or Acrobat.exe processes
• Unusual child processes spawned from Adobe Acrobat Reader applications
• Memory access violations logged in system event logs associated with Adobe processes

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor Adobe Acrobat Reader process behavior for anomalous activity
• Implement application whitelisting to prevent unauthorized code execution from exploited processes
• Configure security information and event management (SIEM) rules to alert on unusual process trees originating from Adobe applications
• Utilize sandbox analysis for incoming PDF attachments before delivery to end users

Monitoring Recommendations

• Monitor for unusual network connections initiated by Adobe Acrobat Reader processes
• Track file system modifications by Adobe Reader processes outside normal working directories
• Implement logging for process creation events to detect suspicious child processes
• Enable Windows Defender Exploit Guard or similar protections to detect memory corruption attempts

How to Mitigate CVE-2022-35667

Immediate Actions Required

• Update all Adobe Acrobat and Adobe Acrobat Reader installations to the latest patched versions immediately
• Enable Protected Mode and Enhanced Security in Adobe Acrobat Reader to limit exploitation impact
• Implement PDF file scanning at email gateways and network ingress points
• Educate users about the risks of opening PDF attachments from untrusted sources

Patch Information

Adobe has addressed this vulnerability in security bulletin APSB22-39. Organizations should update to the following minimum versions or later:

• Adobe Acrobat DC (Continuous): Update beyond version 22.001.20169
• Adobe Acrobat Reader DC (Continuous): Update beyond version 22.001.20169
• Adobe Acrobat (Classic 2020): Update beyond version 20.005.30362
• Adobe Acrobat Reader (Classic 2020): Update beyond version 20.005.30362
• Adobe Acrobat (Classic 2017): Update beyond version 17.012.30249
• Adobe Acrobat Reader (Classic 2017): Update beyond version 17.012.30249

For complete patch details, refer to the Adobe Acrobat Security Advisory.

Workarounds

• Enable Protected Mode in Adobe Acrobat Reader (Edit → Preferences → Security (Enhanced) → Enable Protected Mode at startup)
• Configure Enhanced Security settings to restrict JavaScript execution and URL access
• Use alternative PDF readers in high-security environments until patching is complete
• Implement strict email filtering policies to quarantine PDF attachments for analysis

# Verify Adobe Acrobat Reader version on Windows
reg query "HKLM\SOFTWARE\Adobe\Acrobat Reader\DC\Installer" /v ProductVersion

# Verify Adobe Acrobat Reader version on macOS
defaults read "/Applications/Adobe Acrobat Reader DC.app/Contents/Info.plist" CFBundleShortVersionString