Adobe · Acrobat and Reader
CVE-2008-2992
Adobe Reader and Acrobat Input Validation Vulnerability
What it is
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CISA: Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 24, 2022
- Added to the CISA list
- March 3, 2022
- Published
- November 4, 2008
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.8% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (20)
- http://download.oracle.com/sunalerts/1019937.1.html
- http://www.securityfocus.com/bid/30035
- http://secunia.com/advisories/32700
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=909609
- http://www.securityfocus.com/archive/1/498027/100/0/threaded
- http://secunia.com/secunia_research/2008-14/
- http://www.securityfocus.com/bid/32091
- http://osvdb.org/49520
- http://secunia.com/advisories/35163
- http://secunia.com/advisories/32872
- https://www.exploit-db.com/exploits/7006
- http://securityreason.com/securityalert/4549
- http://www.coresecurity.com/content/adobe-reader-buffer-overflow
- http://www.zerodayinitiative.com/advisories/ZDI-08-072/
- http://www.adobe.com/support/security/bulletins/apsb08-19.html
- http://www.securityfocus.com/archive/1/498055/100/0/threaded
- https://www.exploit-db.com/exploits/6994
- http://www.vupen.com/english/advisories/2009/0098
- http://secunia.com/advisories/29773
- http://www.us-cert.gov/cas/techalerts/TA08-309A.html
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 10, 2023 | Use-After-Free | Acrobat and Reader | High 7.8 | 59% |
| Sep 14, 2023 | Out-of-Bounds Write | Acrobat and Reader | High 7.8 | 6.7% |
| Jun 8, 2022 | Buffer Overflow | Acrobat and Reader | High 7.8 | 87% |
| Jun 8, 2022 | Unspecified | Acrobat and Reader | High 8.8 | 38% |
| Jun 8, 2022 | Universal 3D Remote Code Execution | Acrobat and Reader | High 8.8 | 83% |
| Jun 8, 2022 | Use-After-Free | Acrobat and Reader | High 7.8 | 82% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.