# CVE-2023-26369: Adobe Acrobat PDF Reader RCE when processing TTF fonts

Malformed TTF EBLC/EBDT bitmap tables cause heap OOB write in Adobe libCoolType sfac_GetSbitBitmap, exploited by North Korean actors for Acrobat Reader RCE.

- Payout: Real-world hack
- Severity: high
- Program: Adobe Acrobat Reader on Windows and MacOS
- Credited: Anonymous
- Disclosed: 2023-09-12
- CVE: CVE-2023-26369
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2023/CVE-2023-26369.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2023-26369
- Tags: domain:desktop impact:mass-exploit impact:rce kind:incident platform:project-zero sev:high tech:windows technique:chained technique:reverse-engineering technique:source-review vuln:memory-corruption vuln:rce

**Target:** TrueType font parser (libCoolType) in Adobe Acrobat Reader on Windows/macOS
**Root cause:** sfac_GetSbitBitmap merges glyph bitmaps using EBDT X/Y offsets and advances without validating them against the buffer size allocated by sbit_GetMetrics, so a crafted yOffset*advance index writes past the heap bitmap buffer.
**Steps:**
1. Craft TTF with EBLC bitmapSizeTable (startGlyphIndex 0x4d, endGlyphIndex 0x4e, ppem 0xfa) and two index subtables with imageFormat 0x8 and 0x1.
2. Add EBDT metrics for both glyphs with width 0x61, height 0xa2, Advance 0x8, and ComponentArray glyphCode 0x4e, xOffset 0x20, yOffset 0xa3.
3. Include EBSC table with checksum 0, offset 0xffffffff, len 4294967295 to force parsing only by Adobe libCoolType.
4. Open the PDF/font in Acrobat Reader with PageHeap; crash at CoolType!CTCleanup+0x3ed54 on `or byte ptr [rcx+r9],al` where index = 0xa3*(0x8+0x8)=0xa30 exceeds the 0xA20-byte buffer.
**How found:** Text speculates: smart TTF fuzzing of libCoolType, binary diffing Microsoft TrueType vs Adobe CoolType sbit/sfac functions to spot missing bound checks (similar to CVE-2011-3402/Duqu), or code auditing around bitmap size computation; fuzzing or diffing deemed most likely.
**Exploitation:** JS activates LFH buckets and sprays ArrayBuffer/Array pairs; loading the malicious font corrupts one byte of an ArrayBuffer length field, yielding limited R/W; that is used to overwrite an adjacent Array's length for full arbitrary R/W and addrof; ROP chain and shellcode written to memory; without CFG, TextBox TextSize vtable overwrite hijacks execution; with CFG, RtlCaptureContext leaks stack and return pointers are overwritten to pivot to ROP.
**Escalation:** Chained with a separate sandbox escape (not obtained) as part of a North Korean government-backed campaign targeting security researchers.
**Insight:** Bitmap font tables (EBLC/EBDT) are under-fuzzed relative to glyf/cmap; diff Adobe libCoolType against Microsoft's TrueType sbit/sfac implementations to find missing bounds checks, and use the EBSC table trick to force a font through CoolType only.