deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24075
Published: 2025-03-11
Description: Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24075
CVE: CVE-2025-24076
Published: 2025-03-11
Description: Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24076
CVE: CVE-2025-24077
Published: 2025-03-11
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24077
CVE: CVE-2025-24078
Published: 2025-03-11
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24078
CVE: CVE-2025-24079
Published: 2025-03-11
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24079
CVE: CVE-2025-24080
Published: 2025-03-11
Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24080
CVE: CVE-2025-24081
Published: 2025-03-11
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24081
CVE: CVE-2025-24082
Published: 2025-03-11
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24082
CVE: CVE-2025-24083
Published: 2025-03-11
Description: Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24083
CVE: CVE-2025-24084
Published: 2025-03-11
Description: Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24084
CVE: CVE-2025-24983
Published: 2025-03-11
Description: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24983
CVE: CVE-2025-24984
Published: 2025-03-11
Description: Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984
CVE: CVE-2025-24985
Published: 2025-03-11
Description: Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985; https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-detection-script; https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-mitigation-script
CVE: CVE-2025-24986
Published: 2025-03-11
Description: Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-653
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24986
CVE: CVE-2025-24987
Published: 2025-03-11
Description: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24987
CVE: CVE-2025-24988
Published: 2025-03-11
Description: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24988
CVE: CVE-2025-24991
Published: 2025-03-11
Description: Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24991
CVE: CVE-2025-24992
Published: 2025-03-11
Description: Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24992
CVE: CVE-2025-24993
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24993
CVE: CVE-2025-24994
Published: 2025-03-11
Description: Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24994
CVE: CVE-2025-24995
Published: 2025-03-11
Description: Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24995
CVE: CVE-2025-24996
Published: 2025-03-11
Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24996
CVE: CVE-2025-24997
Published: 2025-03-11
Description: Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24997
CVE: CVE-2025-24998
Published: 2025-03-11
Description: Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24998
CVE: CVE-2025-25003
Published: 2025-03-11
Description: Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25003
CVE: CVE-2025-25008
Published: 2025-03-11
Description: Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25008
CVE: CVE-2025-26627
Published: 2025-03-11
Description: Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26627
CVE: CVE-2025-26629
Published: 2025-03-11
Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26629
CVE: CVE-2025-26630
Published: 2025-03-11
Description: Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26630
CVE: CVE-2025-26631
Published: 2025-03-11
Description: Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26631
CVE: CVE-2025-26633
Published: 2025-03-11
Description: Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-707
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633; https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-detection-script; https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-mitigation-script
CVE: CVE-2025-26634
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26634
CVE: CVE-2025-26645
Published: 2025-03-11
Description: Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26645
CVE: CVE-2025-27172
Published: 2025-03-11
Description: Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-22.html
CVE: CVE-2021-37787
Published: 2025-03-11
Description: The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.abocms.ru/
CVE: CVE-2025-0150
Published: 2025-03-11
Description: Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-696
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25009/
CVE: CVE-2025-0151
Published: 2025-03-11
Description: Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 8.5 (HIGH)
CWE: CWE-416
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25010/
CVE: CVE-2025-24201
Published: 2025-03-11
Description: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/122281; https://support.apple.com/en-us/122283; https://support.apple.com/en-us/122284
CVE: CVE-2025-24431
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-24439
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24440
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24441
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24442
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24443
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24444
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24445
Published: 2025-03-11
Description: Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-16.html
CVE: CVE-2025-24448
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-24449
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-24450
Published: 2025-03-11
Description: Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb25-18.html
CVE: CVE-2025-24451
Published: 2025-03-11
Description: Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb25-18.html
CVE: CVE-2025-24452
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-24453
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-25748
Published: 2025-03-11
Description: A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352
References: https://www.huyvo.net/post/cve-2025-25748-cross-site-request-forgery-csrf-vulnerability-in-hoteldruid-3-0-7
CVE: CVE-2025-25749
Published: 2025-03-11
Description: An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.
CVSS Score: 7.1 (HIGH)
CWE: CWE-521
References: https://www.huyvo.net/post/cve-2025-25749-weak-password-policy-in-hoteldruid-3-0-7
CVE: CVE-2025-26701
Published: 2025-03-11
Description: An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1393
References: https://www.percona.com/blog/security-advisory-cve-affecting-percona-monitoring-and-management-pmm/
CVE: CVE-2025-27158
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2135
CVE: CVE-2025-27159
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-27160
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-27161
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-27162
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-27163
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2134
CVE: CVE-2025-27164
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2136