Adobe products struck by zero-day attacks

Adobe holes
Adobe’s products are once again in the firing line, as hackers are reportedly exploiting critical unpatched vulnerabilities in the products Adobe Reader, Acrobat and Flash Player.

Adobe has published a security advisory describing the problems which affect users regardless of whether they’re running Windows, Mac OS X, Linux, Solaris or UNIX.

Adobe has labelled the zero-day vulnerabilities as “critical”, the most serious rating it has.

Adobe says that Adobe Reader and Acrobat version 8.x are not vulnerable, and that the Flash Player 10.1 release candidate “does not appear to be vulnerable”.

Sign up to our free newsletter.
Security news, advice, and tips.

Although Adobe has published a way to mitigate the problem for Adobe Reader and Acrobat 9.x for Windows, the workaround is clearly not ideal:

Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content.

Mind you, maybe I wouldn’t be so bothered about that in actual fact. After all, when would I ever want to open a PDF containing ShockWave Flash content inside it?

Once again, it sounds as if feature-itis (the technical term for a product suffering from excessive inflation of unnecessary features) could have partly been Adobe’s undoing in this example. A simple PDF reader without so many bells and whistles might not have suffered from such exploitation.

Brad Arkin, director of product security at Adobe, says that the firm is working on a patch – although it is not yet known when it will be available.

Meanwhile, the team at SophosLabs has described some mitigations which can help protect against the Adobe vulnerability on their blog.


Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.