Researchers Find a Zero-Day Attack Targeting Adobe Reader Users

Researchers disclosed a zero-day memory-corruption vulnerability in Adobe Reader that is being exploited via crafted PDF files to achieve remote code execution without additional user interaction; the exploit chain uses layered obfuscation, in-memory shellcode execution, and sandbox bypass techniques to evade AV and EDR, and has been shared among threat intelligence communities with possible links to well-resourced (potentially nation-state) actors. Analysts recommend monitoring abnormal memory allocations, unexpected process spawning from PDF readers, and unusual outbound connections from PDF processes while incident response teams validate logging and response playbooks.