CVE-2022-28246

Think of Adobe Acrobat Reader like a book reader that tries to understand a document’s contents. This bug is like it occasionally reads a tiny bit past where the “page” data should end when the document is specially crafted. That can reveal sensitive details from memory (for example, internal address information), which may help an attacker in later steps.

This matters if your business uses Adobe Acrobat (Adobe Acrobat Reader DC) to open PDF documents from outside your organization. The vulnerability does not require a login, but it does require user interaction—an attacker must get you to open a malicious file. It’s only a risk when an untrusted person can cause you to open a crafted document (for example, via email attachments or downloaded PDFs).

This is a green (lower-priority) issue for most small businesses because exploitation relies on tricking someone into opening a malicious document. There’s no CISA KEV listing and no public exploit code on record, so there’s no confirmed widespread active attack to justify emergency action. Still, you should update promptly through normal patch cycles and tighten how you handle unexpected PDFs.

Confirm exposure

• On each affected machine, open Adobe Acrobat Reader DC and go to Help → About to read the installed version.
• Compare that version to the affected branches described in Adobe’s advisory APS B22-16 (linked below). If your version is in an affected range, plan an update.

Patch / remediation

• Upgrade Adobe Acrobat Reader DC using the fixed version(s) provided by Adobe in APS B22-16:
  • https://helpx.adobe.com/security/products/acrobat/apsb22-16.html
• After updating, re-check Help → About to confirm the new version is installed.

Temporary workaround (if patching is delayed)

• Reduce exposure by preventing employees from opening PDFs from unknown or unexpected sources.
• Ensure your email/security gateway and endpoint scanning tools are enabled, and treat unsolicited attachments as high-risk.

What to monitor

• Monitor for any internal alerts related to malicious PDFs or blocked documents.
• If your environment has application control/allow-lists, ensure Adobe Acrobat Reader DC is kept current and not running outdated copies.

Timeline

• No CISA due date was provided because this issue is not listed in the CISA KEV catalog.

Severity and type

• Weakness: CWE-125 (out-of-bounds read / reading past allocated memory boundaries).
• Impact observed here is information disclosure (memory content exposure), with no stated availability or integrity impact.

How it’s triggered (mechanism)

• The attacker provides a specially crafted file.
• The victim must open that file in Adobe Acrobat Reader DC (user interaction required).
• The reader can perform a read past the end of an allocated memory structure, potentially disclosing sensitive information such as memory addresses.
• The technical description notes this could help bypass mitigations like ASLR by revealing memory layout details.

Exploit status

• CISA KEV: not listed.
• Public exploit code: not present on record.
• Exploitation maturity: not confirmed as widely exploited based on provided findings.

Likelihood signal (prediction)

• EPSS is given as a prediction and is trending upward, but it is overridden from being a public decision driver here because KEV is not present and there’s no confirmed exploitation evidence in the provided findings.

Affected versions

• The backstop indicates affected ranges in specific older branches (as summarized by the vendor advisory), and user interaction (opening a malicious file) is required for exploitation.