CVE-2008-2042: Adobe Acrobat

High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days.

The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback function.

Affected products

• Adobe Acrobat: up to and including 8.1.1; version 3.0 only; version 3.1 only; version 4.0 only; version 4.0.5 only; version 4.0.5a only; …
• Adobe Acrobat Reader: up to and including 8.1.1; version 3.0 only; version 3.01 only; version 3.02 only; version 4.0 only; version 4.0.5 only; …

Published 2008-05-08. Last modified 2026-06-16.