CVE-2019-7111

This vulnerability is like a software “writing past the edge of a box.” If someone sends you a specially made document, Acrobat can mishandle it when you open it. In the worst case, that can allow an attacker to run malicious code on the device.

This matters if your business runs Adobe Acrobat or Adobe Acrobat DC on computers that can receive email attachments or files from the internet. The risk is mainly if an attacker can get a user to open a crafted document with the vulnerable version installed. Only update isn’t enough—ensure the fixed version is installed, because the problem is tied to the specific older releases.

Treat this as a priority update because the vulnerability allows severe impacts (including attacker-controlled code execution) and the likelihood is trending upward. While there is no CISA KEV listing and no public exploit code on record, this is the kind of issue attackers often target once it gets attention. Update to the fixed version promptly on all machines that have affected Acrobat/Reader versions installed.

1. Identify your installed versions

   • On each workstation/server where Adobe Acrobat or Adobe Acrobat DC is installed, open the application and check the version number (typically via the Help/About menu).
   • Record which machines are on versions older than the fixed version.

2. Confirm whether you’re affected

   • The guidance provided specifies that Adobe Acrobat DC is fixed in 15.006.30493.
   • If your Adobe Acrobat DC version is older than 15.006.30493, treat that machine as affected until proven otherwise.

3. Upgrade remediation (exact fixed target)

   • Upgrade Adobe Acrobat DC to 15.006.30493 or newer.
   • Use your organization’s standard software distribution/update method (IT-managed updates, endpoint management tooling, or direct patching) so the change is consistent and auditable.

4. If patching is delayed (temporary risk reduction)

   • Limit the risk from opening untrusted files: restrict who can open external attachments and apply email/file filtering where possible.
   • Avoid opening unexpected documents from email, shared drives, or the web until the update is applied on that machine.
   • Prioritize updating the machines used most often for receiving external documents (mail, web downloads, shared file access).

5. Verify post-update

   • Re-check the version number in Acrobat after the update completes.
   • Restart Acrobat and perform a quick open of a benign PDF to confirm the app is functioning normally.

6. What to monitor after changes

   • Watch for unexpected crashes or unusual behavior on updated and non-updated machines during the transition period.
   • If your organization has endpoint logging/EDR, verify no suspicious Acrobat-related activity is occurring on systems that were previously on older versions.

CISA due date:

• None provided for this issue (it is not listed in the CISA KEV list in the provided findings).

CVE-2019-7111 is a memory-safety flaw categorized as CWE-787 (out-of-bounds write) in Adobe Acrobat/Acrobat DC. The documented/expected trigger pattern is opening a specially crafted document (user interaction). Successful exploitation could lead to arbitrary code execution. In the provided findings, it is not listed in the CISA KEV set, there is no public exploit code on record, and predicted likelihood is rising; however, the public urgency level remains AMBER due to the high potential impact (the vulnerability class and the product involved) and increasing attention. Patch guidance provided: Adobe Acrobat DC is fixed in 15.006.30493.