CVE-2008-2992 is a critical stack-based buffer overflow vulnerability affecting Adobe Acrobat and Reader versions 8.1.2 and earlier. This flaw allows remote attackers to execute arbitrary code by crafting a malicious PDF file that leverages the util.printf JavaScript function with a specially designed format string. With a CVSS score of 7.8 (High), exploitation requires user interaction (opening a malicious PDF) but can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited, listed in CISA's KEV catalog with known ransomware campaign use, and has multiple public Metasploit modules and ExploitDB entries, indicating widespread exploit availability and significant community attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.1.2CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* | ||
<= 8.1.2CPE matchmatch criteria | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* | ||
10CPE matchmatch criteria | cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.