Adobe Reader/Acrobat Collab getIcon Stack Buffer Overflow

Successful exploitation allows remote arbitrary code execution in the context of the user running Adobe Reader or Acrobat. In practical attack chains, this enables delivery and execution of malware from a malicious PDF or other content invoking the vulnerable method. Because the vulnerability was weaponized in exploit kits and reportedly used by threat actors such as APT12, the real-world impact includes reliable initial compromise of victim endpoints, malware installation, and follow-on activity under the compromised user context.

If immediate patching is not possible, reduce exposure by preventing untrusted PDF content from being opened in vulnerable Reader/Acrobat versions, disabling or restricting active scripting and high-risk PDF features where operationally feasible, using application isolation/sandboxing controls, and enforcing least-privilege so code execution does not occur with administrative rights. Email and web filtering to block malicious PDF delivery can further reduce exploitability.

Upgrade Adobe Reader and Adobe Acrobat to fixed versions: 9.1 or later in the 9.x branch, 8.1.3 or later in the 8.x branch, and 7.1.1 or later in the 7.x branch. Standard remediation is to remove or replace unsupported vulnerable versions across the estate and verify that PDF-handling workflows do not invoke legacy installations.