Researchers Say Adobe Reader Zero-Day Has Been Exploited Since December
Summary
Researchers report that attackers have used crafted PDFs to exploit an unpatched Adobe Reader flaw since at least December, harvesting local data and potentially deploying RCE/SBX stages. Adobe had not issued a patch; users were advised to avoid untrusted PDFs.
Key points
- Researcher Haifei Li reported that a zero-day flaw in Adobe Reader has been exploited through crafted PDFs since at least December.
- The exploit reportedly works on the latest Reader version and requires no action beyond opening a PDF.
- Li said the exploit uses Acrobat APIs, including util.readFileIntoStream and RSS.addFeed, to collect local information.
- The exploit may deploy follow-on RCE/SBX stages, potentially enabling further compromise; the article does not confirm that full system takeover occurred.
- Analyst Gi7w0rm found Russian-language lures referencing events in Russia’s oil and gas industry.
- Li advised avoiding PDFs from untrusted sources until Adobe releases a patch; defenders can monitor or block traffic with “Adobe Synchronizer” in the User-Agent header.
Article Details
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Do not open PDF documents received from untrusted contacts until a patch is released.
- Monitor and block HTTP/HTTPS traffic whose User-Agent header contains “Adobe Synchronizer”.
MITRE ATT&CK
T1005 · Data from Local SystemThe exploit harvests local information using Acrobat APIs, including util.readFileIntoStream and RSS.addFeed.T1203 · Exploitation for Client ExecutionThe PDF exploit targets an unpatched Adobe Reader vulnerability and can deploy follow-on RCE stages.T1204.002 · Malicious FileThe exploit requires the victim to open a specially crafted PDF.