CVE-2022-35672: Adobe Acrobat DC RCE Vulnerability

CVE-2022-35672 Overview

CVE-2022-35672 is an out-of-bounds read vulnerability affecting Adobe Acrobat Reader that can lead to arbitrary code execution. The vulnerability occurs when parsing a specially crafted file, causing a read past the end of an allocated memory structure. An attacker who successfully exploits this vulnerability could execute code in the context of the current user, potentially gaining full control of the affected system.

This vulnerability requires user interaction to exploit—specifically, a victim must open a malicious PDF file. Given Adobe Acrobat Reader's widespread use in enterprise and consumer environments for document handling, this vulnerability presents a significant risk for targeted attacks via malicious document delivery.

Critical Impact

Successful exploitation allows arbitrary code execution in the context of the current user, enabling attackers to install programs, view/change/delete data, or create new accounts with full user rights.

Affected Products

• Adobe Acrobat DC (Continuous) version 22.001.20085 and earlier
• Adobe Acrobat Reader DC (Continuous) version 22.001.20085 and earlier
• Adobe Acrobat (Classic 2020) version 20.005.30314 and earlier
• Adobe Acrobat Reader (Classic 2020) version 20.005.30314 and earlier
• Adobe Acrobat (Classic 2017) version 17.012.30205 and earlier
• Adobe Acrobat Reader (Classic 2017) version 17.012.30205 and earlier
• Affected on both Microsoft Windows and Apple macOS platforms

Discovery Timeline

• 2022-07-27 - CVE-2022-35672 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35672

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption flaw that occurs when software reads data past the end or before the beginning of the intended buffer. In the context of Adobe Acrobat Reader, this vulnerability manifests during the parsing of specially crafted PDF files.

When the application processes certain malformed data structures within a PDF, it fails to properly validate buffer boundaries before performing read operations. This allows an attacker to craft a malicious file that triggers the out-of-bounds read condition, potentially leaking sensitive memory contents or corrupting program execution flow to achieve code execution.

The local attack vector means the attacker must deliver the malicious PDF to the target system, typically through phishing emails, malicious downloads, or compromised websites. No elevated privileges are required to execute the attack, but user interaction is mandatory—the victim must open the malicious document.

Root Cause

The root cause of CVE-2022-35672 lies in insufficient bounds checking during PDF file parsing operations. When Adobe Acrobat Reader processes certain data structures within a PDF document, the application performs memory read operations without adequately verifying that the requested data falls within the allocated buffer boundaries.

This deficiency allows specially crafted input to trigger memory reads beyond the intended buffer, potentially exposing sensitive information from adjacent memory regions or causing memory corruption that can be leveraged for code execution.

Attack Vector

The attack vector for CVE-2022-35672 follows a document-based exploitation approach:

1. Malicious Document Creation: An attacker crafts a PDF file containing malformed data structures designed to trigger the out-of-bounds read condition during parsing.

2. Document Delivery: The malicious PDF is delivered to the target through common attack channels such as phishing emails with attachments, drive-by downloads from compromised websites, or shared network locations.

3. User Interaction: The victim opens the malicious PDF file using a vulnerable version of Adobe Acrobat or Adobe Acrobat Reader.

4. Exploitation: Upon parsing the malformed content, the out-of-bounds read is triggered, allowing the attacker to execute arbitrary code with the privileges of the current user.

The vulnerability affects multiple product tracks (Continuous and Classic) across both Windows and macOS platforms, broadening the potential attack surface significantly.

Detection Methods for CVE-2022-35672

Indicators of Compromise

• Unexpected Adobe Acrobat Reader crashes when opening PDF files, particularly those received from unknown or suspicious sources
• Anomalous child processes spawned by AcroRd32.exe or Acrobat.exe on Windows, or equivalent processes on macOS
• Suspicious network connections originating from Adobe Acrobat processes following document opening
• Memory access violations or exception logs related to Adobe Reader components in system event logs

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process behavior following PDF file access
• Implement file integrity monitoring on Adobe Acrobat installations to detect unauthorized modifications
• Configure email gateway solutions to scan PDF attachments for known malicious indicators and sandbox suspicious files
• Enable enhanced logging for Adobe Acrobat Reader to capture parsing errors and memory violations
• Utilize behavioral analysis to detect anomalous activity patterns from document reader processes

Monitoring Recommendations

• Monitor for unusual parent-child process relationships where Adobe Acrobat spawns shells, scripting engines, or other unexpected executables
• Track file system activity following PDF document opens, particularly writes to sensitive directories or creation of new executable files
• Implement network traffic analysis to identify post-exploitation command and control communications from document reader processes
• Review system logs for Adobe Acrobat Reader crash reports that may indicate exploitation attempts

How to Mitigate CVE-2022-35672

Immediate Actions Required

• Update all Adobe Acrobat and Acrobat Reader installations to the latest available versions immediately
• Conduct an inventory of all systems running vulnerable Adobe Acrobat versions across the organization
• Block suspicious PDF attachments at email gateways until patching is complete
• Educate users about the risks of opening PDF files from untrusted sources
• Enable Protected View in Adobe Acrobat Reader to provide an additional layer of protection

Patch Information

Adobe has released security updates to address this vulnerability as documented in Adobe Security Advisory APSB22-16. Organizations should upgrade to:

• Continuous Track: Adobe Acrobat DC and Acrobat Reader DC version 22.001.20169 or later
• Classic 2020 Track: Version 20.005.30362 or later
• Classic 2017 Track: Version 17.012.30249 or later

The updates are available through Adobe's standard update mechanisms, the Creative Cloud desktop application, and direct downloads from the Adobe website.

Workarounds

• Enable Protected View in Adobe Acrobat Reader by navigating to Edit > Preferences > Security (Enhanced) and selecting "Files from potentially unsafe locations"
• Configure PDF files to open in Protected Mode by default in enterprise environments via Group Policy or Adobe Customization Wizard
• Implement application control policies to restrict PDF opening to trusted, verified documents only
• Consider using alternative PDF readers temporarily for systems that cannot be immediately patched
• Deploy network segmentation to limit potential lateral movement in case of successful exploitation

# Windows Registry configuration to enable Protected View
reg add "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\TrustManager" /v bEnhancedSecurityInBrowser /t REG_DWORD /d 1 /f
reg add "HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\TrustManager" /v bEnhancedSecurityStandalone /t REG_DWORD /d 1 /f