CVE-2008-2992: Adobe Reader and Acrobat Input Validation Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 98.5% chance of exploitation in the next 30 days.

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

Affected products

• Adobe Acrobat: up to and including 8.1.2
• Adobe Acrobat Reader: up to and including 8.1.2
• Oracle Solaris: version 10 only

Published 2008-11-04. Last modified 2026-06-16.