Netskope Threat Labs

FILE-PDF Adobe Reader malformed CID identity-H font file out of bounds read attempt

IPS-SWG

2 SIDs: 39643, 39731

First seen
April 2022
Last seen
September 2026

Detects a PDF exploiting CVE-2016-4206, an out-of-bounds read in Adobe Reader's CID font handling that can leak memory. The rule matches the malformed identity encoded fonts that public exploits use to read beyond allocated buffers.