In summary:
- PCWorld reports that Adobe Acrobat Reader contains an unpatched zero-day vulnerability that hackers have actively exploited since December.
- Simply opening a malicious PDF file can enable attackers to steal data and potentially gain remote control of your system.
- Users should immediately stop opening PDF files from untrusted sources until Adobe releases a security patch for this critical flaw.
According to BleepingComputer, there’s a serious vulnerability in Acrobat Reader that can be exploited to steal sensitive data.
Security researcher Haifei Li says that hackers have been abusing this “highly sophisticated, fingerprinting-style PDF exploit” since December, meaning just over four months.
“This ‘fingerprinting’ exploit has been confirmed to leverage a zero-day/unpatched vulnerability that works on the latest version of Adobe Reader without requiring any user interaction beyond opening a PDF file. Even more concerning, this exploit allows the threat actor to not only collect/steal local information but also potentially launch subsequent RCE/SBX attacks, which could lead to full control of the victim’s system.”
In short, all it takes is opening an infected PDF file to expose your system to an attacker. From there, the attacker could steal your data or even run their own code and take full control of your machine.
Until Adobe patches the vulnerability, Acrobat Reader users are advised to not open PDF files from untrusted sources—which is honestly good sense even without the threat of this exploit.
This article originally appeared on our sister publication PC för Alla and was translated and localized from Swedish.
Author: Mikael Markander, Contributor, PCWorld
Mikael writes news across all our consumer tech categories. He has previously worked with Macworld, but today mainly writes for our sister sites PC för Alla and M3. Mikael has a firm grasp on which gadgets are released, and what is happening with the streaming services and the latest AI tools.