HowToFixMe
● High · CVSS 8.8 ⚠ ACTIVELY EXPLOITED, CISA KEV

How to Fix CVE-2008-0655: Multiple Vulnerabilities in Adobe Reader and Acrobat Before 8.1.2

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
Vendor / productAdobe: Reader and Acrobat
SeverityCVSS 8.8 - High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Actively exploited?Yes, listed in CISA KEV (added 2022-06-08)
AffectedAdobe Reader and Acrobat before 8.1.2
Fixed inVersion 8.1.2 (Adobe bulletin APSB08-13)
Type (CWE)CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Exploitation status

CVE-2008-0655 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Adobe Acrobat and Reader Unspecified Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-06-08, federal due date 2022-06-22.

What is CVE-2008-0655?

CVE-2008-0655 covers multiple unspecified vulnerabilities in Adobe Reader and Acrobat before version 8.1.2. The MITRE record is deliberately terse: it states the flaws have “unknown impact and attack vectors.” Adobe rolled several distinct issues into a single advisory (APSB08-13) and the 8.1.2 release that closed them, without publishing per-issue technical breakdowns. CISA's later enrichment classifies the bundle under CWE-200, exposure of sensitive information to an unauthorized actor.

In practice this is a client-side document handling problem, not a network service flaw. Adobe Reader and Acrobat are desktop applications that parse PDF files. The CVSS 3.1 vector assigned by CISA — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — tells the story: network attack vector, but with user interaction required. The realistic delivery is a malicious PDF: a victim opens an attacker-crafted document, email attachment, or web-hosted file, and the parsing flaw triggers. There is no listening port to scan and no remote daemon to firewall. The exposed asset is whatever the Reader or Acrobat process can read on the victim's machine, and at high integrity and availability impact, full code execution in the user's context is the assumed worst case.

Why this CVE matters

Two things make a 2008 PDF bug worth a remediation ticket in 2026. First, CISA added CVE-2008-0655 to the Known Exploited Vulnerabilities catalog on 2022-06-08 — fourteen years after disclosure — which only happens when active, observed exploitation justifies it. Old Reader and Acrobat 8.x installs are still being attacked. Second, those installs are exactly the kind that get missed: a document-processing server with a frozen software baseline, a kiosk that opens PDFs full-screen, an offline imaging workstation, or a bundled Reader buried inside a line-of-business application. None of them auto-update.

If you find an Adobe Reader or Acrobat build earlier than 8.1.2 anywhere in your estate, treat it as a live, weaponised target. The fix is mature and well understood, so the only real cost here is finding every copy.

Identify which installs are affected

You are looking for any Adobe Reader or Acrobat install with a version earlier than 8.1.2. The version string is the authoritative signal — the marketing name (Reader 8, Acrobat 8 Professional, Acrobat 3D) does not tell you the point release.

On Windows, enumerate every installed Adobe Reader/Acrobat and read its version from the registry uninstall keys (covers both 32-bit and 64-bit hives):

# Find all Adobe Reader / Acrobat installs and their versions
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Adobe (Reader|Acrobat)' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation |
  Sort-Object DisplayName
# Any DisplayVersion below 8.1.2 (e.g. 8.0.0, 8.1.0, 8.1.1) is vulnerable.

On Linux, where Adobe shipped Reader 8.x as AdobeReader / acroread, check the package and the binary:

# Adobe Reader for Linux was distributed as AdobeReader / acroread
rpm -q AdobeReader 2>/dev/null              # RHEL / SUSE packaged builds
dpkg -l 'adobereader*' 2>/dev/null          # Debian-packaged builds
acroread -version 2>/dev/null               # ask the binary directly
# Anything below 8.1.2 is affected; 8.1.2 is the patched Linux build (APSB08-13).

How to fix CVE-2008-0655

The fix is unambiguous: upgrade Adobe Reader and Acrobat to version 8.1.2 or later. That is the build named in Adobe Security Bulletin APSB08-13, and it is the same fixed version called out in the MITRE description (“before 8.1.2”). There is no configuration toggle or hotfix that substitutes for the version change. Because modern Acrobat DC / Reader DC are many major versions past 8.1.2, the cleanest remediation in most environments is to remove the legacy 8.x install entirely and deploy a current, supported release.

Upgrade on Windows

Adobe distributed the 8.1.2 update as an MSP patch over an existing 8.x MSI install, and as a full installer. For a managed fleet, push the update (or a current Reader/Acrobat) through your existing software deployment tool. A representative silent install:

# Apply the Adobe-supplied 8.1.2 update silently over an existing 8.x install.
# AdbeRdrUpd812.msp is the Adobe patch file from APSB08-13.
Start-Process msiexec.exe -ArgumentList '/p "C:\Patches\AdbeRdrUpd812.msp" /qn /norestart' -Wait

# Confirm the resulting version is 8.1.2 or later:
Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -EA SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Adobe (Reader|Acrobat)' } |
  Select-Object DisplayName, DisplayVersion

If you cannot source the exact 8.1.2 patch (it is a legacy file), the supported path is to uninstall the old 8.x product and install a current Acrobat/Reader release. Do not leave the 8.x install behind after deploying a newer one — both will sit on disk and a scanner will keep flagging the old binary.

Upgrade on Linux

For the Linux distributions that packaged Adobe Reader, the vendor errata that shipped 8.1.2 are the canonical source: Red Hat RHSA-2008:0144, SUSE SUSE-SA:2008:009, and Gentoo GLSA-200803-01 (all linked in the References below). Apply through the native package manager so the patched build replaces the vulnerable one:

# RHEL / CentOS. pull the AdobeReader update from the RHSA-2008:0144 errata
sudo yum update AdobeReader

# SUSE, apply the SUSE-SA:2008:009 update
sudo zypper update AdobeReader

# Gentoo: GLSA-200803-01 fixed package
sudo emerge --ask --oneshot --update app-text/acroread

# Verify the binary now reports 8.1.2 or later
acroread -version

Note that Adobe ended support for Reader on Linux years ago. If these packages are no longer in your repositories, the correct outcome is to remove acroread entirely and standardise on a maintained PDF viewer — a long-dead Reader 8.x is a liability regardless of this single CVE.

If you can't patch immediately

Patching to 8.1.2 (or replacing the product) is the only real fix. Because the attack requires a user to open a malicious PDF, the interim mitigations all aim at that delivery path:

None of these remove the parsing flaw. They shrink the window until 8.1.2 is deployed or the product is removed.

Confirm the fix held

After upgrading, re-enumerate every Adobe Reader and Acrobat install on the host and confirm each one reports 8.1.2 or later. The most common reason a scanner keeps flagging CVE-2008-0655 after a “successful” patch is a second copy left on disk — a per-user install, a Reader bundled inside another application, or an old MSI an in-place upgrade did not remove.

# Windows: assert no Adobe Reader/Acrobat below 8.1.2 remains
$bad = Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
                        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -EA SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Adobe (Reader|Acrobat)' -and [version]($_.DisplayVersion) -lt [version]'8.1.2' }
if ($bad) { $bad | Select DisplayName, DisplayVersion; "STILL VULNERABLE" } else { "Clean: all installs >= 8.1.2" }

Then run an authenticated vulnerability scan with a current signature set and confirm it no longer reports CVE-2008-0655. Because this CVE is on the CISA KEV list as actively exploited, if a host ran an unpatched 8.x build while exposed, review it for compromise: check for unexpected child processes spawned by the Reader/Acrobat executable, new local accounts or scheduled tasks, and unexplained outbound connections over the exposure window.

Frequently asked questions

Which versions are vulnerable, and what fixes CVE-2008-0655?

Adobe Reader and Acrobat before 8.1.2 are affected. Upgrade to version 8.1.2 — that is the build named in Adobe bulletin APSB08-13 and the fixed version stated in the MITRE record. On Linux, the matching errata are RHSA-2008:0144, SUSE-SA:2008:009, and GLSA-200803-01.

Why does the CVE give no technical detail about the flaw?

MITRE describes it as “multiple unspecified vulnerabilities ... with unknown impact and attack vectors.” Adobe fixed several distinct issues in the single 8.1.2 release without publishing per-issue specifics. CISA later mapped the bundle to CWE-200 (information exposure) and confirmed it is being exploited.

Is this still relevant if I run modern Acrobat?

No — current Acrobat DC and Reader DC are far past 8.1.2 and are not affected. The exposure is legacy Reader/Acrobat 8.x installs that were never upgraded, which is exactly why CISA added it to KEV in 2022.

I patched but the scanner still flags it. What did I miss?

Almost always a second install of Reader or Acrobat is still present — a per-user copy, an embedded Reader inside another product, or an old version an upgrade left behind. Enumerate every Adobe Reader/Acrobat on the host and confirm each reports 8.1.2 or later.

References

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Operational notes for fleet remediation

The hard part of CVE-2008-0655 is not the patch — 8.1.2 has existed since 2008 — it is discovery. Adobe Reader and Acrobat 8.x get installed in places that fall outside normal patch tooling, so a clean vulnerability report depends on finding every copy, not on the upgrade mechanics. The notes below focus on that.

Where legacy Reader/Acrobat 8.x hides

Five locations account for most surviving installs. Per-user installs under a profile that a machine-wide deployment tool never touches. Reader bundled inside a third-party application: scanning suites, ERP clients, and label-printing software historically shipped their own embedded Reader. Frozen baselines on imaging or document-processing servers where “do not change the software” was the standing rule. Kiosks and signage hosts that open PDFs full-screen and were imaged once, then forgotten. And portable or extracted copies that were never registered with an installer, so they appear in neither the registry uninstall keys nor the package database. An authenticated scan combined with a filesystem search for the Reader/Acrobat executable catches the copies a registry-only check misses.

Authoritative sources for this CVE

The fixed-in version is settled: the MITRE record states “before 8.1.2” and Adobe bulletin APSB08-13 names 8.1.2 as the release that closes the issues. For the Linux side, the distribution errata in the References block below (RHSA-2008:0144, SUSE-SA:2008:009, GLSA-200803-01) are the canonical source for the packaged builds. CISA's KEV catalog is the authority for the active-exploitation status and the 2022-06-08 listing date. Treat aggregator and blog summaries as secondary to those.

Verification that actually closes the finding

A green close on CVE-2008-0655 needs two facts proven, not one. First, that every Adobe Reader/Acrobat install on the host reports 8.1.2 or later: the PowerShell assertion in the section above returns “STILL VULNERABLE” with the offending DisplayName if any copy sits below that line, which is the check most partial fixes fail. Second, that an authenticated scanner with current signatures no longer reports the CVE for the host. If those two agree, the finding is genuinely closed. If the scanner still flags it after the version check passes, you have a second install the version check did not enumerate, so search the filesystem for stray Reader/Acrobat binaries and re-check.

Other CVEs touching related code paths, worth patching together with this one:

People also ask

Which versions are vulnerable, and what fixes CVE-2008-0655?

Adobe Reader and Acrobat before 8.1.2 are affected. Upgrade to version 8.1.2, the build named in Adobe bulletin APSB08-13 and the fixed version stated in the MITRE record. On Linux, the matching errata are RHSA-2008:0144, SUSE-SA:2008:009, and GLSA-200803-01.

Why does the CVE give no technical detail about the flaw?

MITRE describes it as "multiple unspecified vulnerabilities ... with unknown impact and attack vectors." Adobe fixed several distinct issues in the single 8.1.2 release without publishing per-issue specifics. CISA later mapped the bundle to CWE-200 (information exposure) and confirmed it is being exploited.

Is this still relevant if I run modern Acrobat?

No. current Acrobat DC and Reader DC are far past 8.1.2 and are not affected. The exposure is legacy Reader/Acrobat 8.x installs that were never upgraded, which is exactly why CISA added it to KEV in 2022.

I patched but the scanner still flags it. What did I miss?

Almost always a second install of Reader or Acrobat is still present, a per-user copy, an embedded Reader inside another product, or an old version an upgrade left behind. Enumerate every Adobe Reader/Acrobat on the host and confirm each reports 8.1.2 or later.