CVE-2022-27799

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27808.1In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB reques CVE-2022-278007.8Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after CVE-2022-278017.8Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after CVE-2022-278027.8Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after CVE-2022-278034.3Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of CVE-2022-278049.8An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One S CVE-2022-278059.8An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an CVE-2022-278067.2On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur CVE-2022-278074.3Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Cat CVE-2022-278087.8Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 ma CVE-2022-27815.3In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and v CVE-2022-278107.5It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.