|CVSS SCORE||7.8, (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)|
Acrobat Reader DC
This vulnerability allows remote attackers to escape the sandbox on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the Net.HTTP.request method. The component exposes an undocumented verb that allows an attacker to open a mini-browser session. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process.
Adobe has issued an update to correct this vulnerability. More details can be found at:
|CREDIT||AbdulAziz Hariri of Haboob SA