CVE-2022-24103

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
AdobeAcrobat Reader>= unspecified, <= 22.001.20085; >= unspecified, <= 20.005.3031x; >= unspecified, <= 17.012.30205; >= unspecified, <= None

References

Timeline

Published
May 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-241047.8Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-afterCVE-2022-241057.8Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could resultCVE-2022-241067.8In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the imagCVE-2022-241077.8Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.CVE-2022-241089.8The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameterCVE-2022-241096.5An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent withCVE-2022-24114.8The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users sCVE-2022-241106.5Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.CVE-2022-241115.3In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and pCVE-2022-241129.8An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of ApachCVE-2022-241137.8Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber ProtCVE-2022-241147.0Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Off