Acrobat CVE-2025-43573

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS Vector Analysis: AV:L/AC:L/PR:N/UI:R indicates low barrier to exploitation—any user can trigger it via email attachment or web download without prior authentication; (2) Exploitation Probability: The UAF class combined with AC:L suggests reliable, reproducible exploitation is feasible; proof-of-concept development is likely already underway or exists given public disclosure; (3) Impact Severity: Confidentiality, Integrity, and Availability all marked HIGH—attackers achieve full code execution in user context with capability to steal data, modify documents, or pivot to lateral movement; (4) User Interaction Requirement: While UI:R mandates user action, the attack vector (opening a PDF) is a routine workflow for document professionals, legal/finance teams, and general office workers, making social engineering highly effective; (5) Automatable Risk: Exploitation can be automated in spear-phishing or mass malware distribution campaigns targeting verticals handling sensitive PDFs. This is not a theoretical high-CVSS issue—it represents practical, immediately exploitable risk. Organizations cannot mitigate through network segmentation alone; endpoint patching is critical.

A targeted attack scenario: (1) Attacker crafts a malicious PDF file embedding a UAF trigger that corrupts the Acrobat Reader heap and redirects execution to attacker-controlled shellcode; (2) PDF is delivered via spear-phishing email to finance department employee with subject line referencing invoices or contracts; (3) User opens PDF in Acrobat Reader (AV:L, UI:R satisfied); (4) UAF vulnerability is triggered during PDF parsing, allowing heap memory to be controlled; (5) Attacker's shellcode executes in the context of the user (typically a privileged employee with access to financial systems or confidential data); (6) Payload establishes reverse shell, exfiltrates credentials from browser cookies/password managers, or deploys secondary malware for lateral movement into network infrastructure. Alternatively, in a mass-exploitation scenario: malicious PDFs are hosted on compromised websites or legitimate ad networks; victims visiting these sites or downloading documents trigger automatic exploitation, turning Acrobat Reader into an initial access vector for botnet enrollment or ransomware campaigns. No POC exploitation code is assumed to be publicly available at disclosure, but development timeline for reliable exploitation is typically 7-14 days post-CVE publication for UAF vulnerabilities.