CVE-2015-6721

Vulnerability

The vulnerability exists in the CBSharedReviewSecurityDialog method of Adobe Reader and Acrobat. It allows attackers to bypass JavaScript API execution restrictions. The affected versions include Adobe Reader and Acrobat 10.x before 10.1.16, 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X [1].

Exploitation

An attacker can exploit this vulnerability by creating a specially crafted PDF file with specific JavaScript instructions. User interaction is required, as the target must open the malicious file or visit a malicious page. No authentication or special network position is needed; the attack can be delivered remotely [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, leading to full compromise of the affected system. This includes potential data theft, installation of malware, or other malicious actions [1].

Mitigation

Adobe has released fixes in versions 10.1.16, 11.0.13, DC Classic 2015.006.30094, and DC Continuous 2015.009.20069, available as of October 13, 2015 [1]. Users should update to the latest versions. No workarounds have been published, and this CVE is not known to be listed in CISA's Known Exploited Vulnerabilities catalog.