| BugId: | AVR:PoisonUninitialized+0x5E 237.b22 | 
| Location: | acrord32.exe!acrord32.dll+0x605454 | 
| Description: | An Access Violation exception happened at 0xC0C0C11E while attempting to read memory at 0xC0C0C11E using a pointer that was not initialized. | 
| Version: | AcroRd32.exe: 18.11.20040.19174 (x86) AcroRd32.dll: 18.11.20040.19174 (x86)  | 
| Security impact: | Potentially exploitable security issue | 
| Arguments: | ['/n', 'AVR@PoisonUninitialized@0x605454.pdf'] | 
| eax = 0xC0C0C0C0 | xmm0 = 0x0 | 
| ebx = 0x0 | xmm1 = 0x0 | 
| ecx = 0xC0C0C0C0 | xmm2 = 0x0 | 
| edx = 0x38A0000 | xmm3 = 0x0 | 
| esi = 0x3D934F88 | xmm4 = 0x0 | 
| edi = 0x0 | xmm5 = 0x0 | 
| esp = 0x99BEB0 | xmm6 = 0x0 | 
| ebp = 0x99BF20 | xmm7 = 0x0 | 
| 5ee05384 | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee05387 | e84bc90000 | call AcroRd32!CTJPEGRect::operator=+0x11cb6 (5ee11cd7) | 
| 5ee0538c | 8b462c | mov eax,dword ptr [esi+2Ch] | 
| 5ee0538f | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee05392 | 33db | xor ebx,ebx | 
| 5ee05394 | 8945b4 | mov dword ptr [ebp-4Ch],eax | 
| 5ee05397 | 895dfc | mov dword ptr [ebp-4],ebx | 
| 5ee0539a | e836ca0000 | call AcroRd32!CTJPEGRect::operator=+0x11db4 (5ee11dd5) | 
| 5ee0539f | 6a10 | push 10h | 
| 5ee053a1 | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee053a4 | e872c90000 | call AcroRd32!CTJPEGRect::operator=+0x11cfa (5ee11d1b) | 
| 5ee053a9 | 8bf8 | mov edi,eax | 
| 5ee053ab | 85ff | test edi,edi | 
| 5ee053ad | 752f | jne AcroRd32!CTJPEGRect::operator=+0x53bd (5ee053de) | 
| 5ee053af | ff765c | push dword ptr [esi+5Ch] | 
| 5ee053b2 | 8d45d0 | lea eax,[ebp-30h] | 
| 5ee053b5 | 50 | push eax | 
| 5ee053b6 | 8d45a0 | lea eax,[ebp-60h] | 
| 5ee053b9 | 50 | push eax | 
| 5ee053ba | e8ddda0000 | call AcroRd32!CTJPEGRect::operator=+0x12e7b (5ee12e9c) | 
| 5ee053bf | 8bf8 | mov edi,eax | 
| 5ee053c1 | 83c40c | add esp,0Ch | 
| 5ee053c4 | 85ff | test edi,edi | 
| 5ee053c6 | 7516 | jne AcroRd32!CTJPEGRect::operator=+0x53bd (5ee053de) | 
| 5ee053c8 | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee053cb | e827e7ffff | call AcroRd32!CTJPEGRect::operator=+0x3ad6 (5ee03af7) | 
| 5ee053d0 | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh | 
| 5ee053d4 | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee053d7 | e818c90000 | call AcroRd32!CTJPEGRect::operator=+0x11cd3 (5ee11cf4) | 
| 5ee053dc | eb6a | jmp AcroRd32!CTJPEGRect::operator=+0x5427 (5ee05448) | 
| 5ee053de | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh | 
| 5ee053e2 | 8d4da0 | lea ecx,[ebp-60h] | 
| 5ee053e5 | e80ac90000 | call AcroRd32!CTJPEGRect::operator=+0x11cd3 (5ee11cf4) | 
| 5ee053ea | 8bc7 | mov eax,edi | 
| 5ee053ec | e98b000000 | jmp AcroRd32!CTJPEGRect::operator=+0x545b (5ee0547c) | 
| 5ee053f1 | 8b462c | mov eax,dword ptr [esi+2Ch] | 
| 5ee053f4 | 8d4dbc | lea ecx,[ebp-44h] | 
| 5ee053f7 | c6400d08 | mov byte ptr [eax+0Dh],8 | 
| 5ee053fb | e8aa0b0100 | call AcroRd32!CTJPEGRect::operator=+0x15f89 (5ee15faa) | 
| 5ee05400 | 8b462c | mov eax,dword ptr [esi+2Ch] | 
| 5ee05403 | 8d4dbc | lea ecx,[ebp-44h] | 
| 5ee05406 | c745fc01000000 | mov dword ptr [ebp-4],1 | 
| 5ee0540d | 8945cc | mov dword ptr [ebp-34h],eax | 
| 5ee05410 | e884120100 | call AcroRd32!CTJPEGRect::operator=+0x16678 (5ee16699) | 
| 5ee05415 | 33db | xor ebx,ebx | 
| 5ee05417 | 8d4dbc | lea ecx,[ebp-44h] | 
| 5ee0541a | 53 | push ebx | 
| 5ee0541b | ff765c | push dword ptr [esi+5Ch] | 
| 5ee0541e | e8a90c0100 | call AcroRd32!CTJPEGRect::operator=+0x160ab (5ee160cc) | 
| 5ee05423 | 8bf8 | mov edi,eax | 
| 5ee05425 | 8d4dbc | lea ecx,[ebp-44h] | 
| 5ee05428 | 85ff | test edi,edi | 
| 5ee0542a | 740b | je AcroRd32!CTJPEGRect::operator=+0x5416 (5ee05437) | 
| 5ee0542c | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh | 
| 5ee05430 | e8cbbb9fff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo (5e801000) | 
| 5ee05435 | ebb3 | jmp AcroRd32!CTJPEGRect::operator=+0x53c9 (5ee053ea) | 
| 5ee05437 | e8ee110100 | call AcroRd32!CTJPEGRect::operator=+0x16609 (5ee1662a) | 
| 5ee0543c | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh | 
| 5ee05440 | 8d4dbc | lea ecx,[ebp-44h] | 
| 5ee05443 | e8b8bb9fff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo (5e801000) | 
| 5ee05448 | 807e0424 | cmp byte ptr [esi+4],24h | 
| 5ee0544c | 742c | je AcroRd32!CTJPEGRect::operator=+0x5459 (5ee0547a) | 
| 5ee0544e | 8b4664 | mov eax,dword ptr [esi+64h] | 
| 5ee05451 | 8b4e60 | mov ecx,dword ptr [esi+60h] | 
| 5ee05454 | 6639585e | cmp word ptr [eax+5Eh],bx // current instruction | 
| 5ee05458 | 7406 | je AcroRd32!CTJPEGRect::operator=+0x543f (5ee05460) | 
| 5ee0545a | 0fb64654 | movzx eax,byte ptr [esi+54h] | 
| 5ee0545e | eb04 | jmp AcroRd32!CTJPEGRect::operator=+0x5443 (5ee05464) | 
| 5ee05460 | 0fb6405a | movzx eax,byte ptr [eax+5Ah] | 
| 5ee05464 | 50 | push eax | 
| 5ee05465 | ff7650 | push dword ptr [esi+50h] | 
| 5ee05468 | ff764c | push dword ptr [esi+4Ch] | 
| 5ee0546b | ff765c | push dword ptr [esi+5Ch] | 
| 5ee0546e | e8f41b0000 | call AcroRd32!CTJPEGRect::operator=+0x7046 (5ee07067) | 
| 5ee05473 | 8bce | mov ecx,esi | 
| 5ee05475 | e835e1feff | call AcroRd32!AX_PDXlateToHostEx+0x25e381 (5edf35af) | 
| 5ee0547a | 33c0 | xor eax,eax | 
| 5ee0547c | e8a81da2ff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo+0x26229 (5e827229) | 
| 5ee05481 | c3 | ret | 
| 5ee05482 | 56 | push esi | 
| 5ee05483 | 8bf1 | mov esi,ecx | 
| 5ee05485 | e86c130100 | call AcroRd32!CTJPEGRect::operator=+0x167d5 (5ee167f6) | 
| 5ee0548a | 85c0 | test eax,eax | 
| 5ee0548c | 7570 | jne AcroRd32!CTJPEGRect::operator=+0x54dd (5ee054fe) | 
| 5ee0548e | 8b4e2c | mov ecx,dword ptr [esi+2Ch] | 
| 5ee05491 | e81de0feff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) | 
| 5ee05496 | a801 | test al,1 | 
| 5ee05498 | 8ad0 | mov dl,al | 
| 5ee0549a | 0f97c1 | seta cl | 
| 5ee0549d | d0ea | shr dl,1 | 
| 5ee0549f | 80e203 | and dl,3 | 
| 5ee054a2 | 0fb6c9 | movzx ecx,cl | 
| 5ee054a5 | a808 | test al,8 | 
| 5ee054a7 | 66894e68 | mov word ptr [esi+68h],cx | 
| 5ee054ab | 88566a | mov byte ptr [esi+6Ah],dl | 
| 5ee054ae | 0f97c0 | seta al | 
| 5ee054b1 | 0fb6c0 | movzx eax,al | 
| 5ee054b4 | 6689466c | mov word ptr [esi+6Ch],ax | 
| 5ee054b8 | 6685c9 | test cx,cx | 
| 5ee054bb | 753f | jne AcroRd32!CTJPEGRect::operator=+0x54db (5ee054fc) | 
| 5ee054bd | 84d2 | test dl,dl | 
| 5ee054bf | 7525 | jne AcroRd32!CTJPEGRect::operator=+0x54c5 (5ee054e6) | 
| 5ee054c1 | 53 | push ebx | 
| 5ee054c2 | 57 | push edi | 
| 5ee054c3 | 6a04 | push 4 | 
| 5ee054c5 | 8d7e74 | lea edi,[esi+74h] | 
| 5ee054c8 | 5b | pop ebx | 
| 5ee054c9 | 8b4e2c | mov ecx,dword ptr [esi+2Ch] | 
| 5ee054cc | e8e2dffeff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) | 
| 5ee054d1 | 8847fc | mov byte ptr [edi-4],al | 
| 5ee054d4 | 8b4e2c | mov ecx,dword ptr [esi+2Ch] | 
| 5ee054d7 | e8d7dffeff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) | 
| 5ee054dc | 8807 | mov byte ptr [edi],al | 
| 5ee054de | 47 | inc edi | 
| 5edf335c | 8bd9 | mov ebx,ecx | 
| 5edf335e | e8b6a3a3ff | call AcroRd32!AcroWinMainSandbox+0x3795 (5e82d719) | 
| 5edf3363 | 59 | pop ecx | 
| 5edf3364 | 8bc8 | mov ecx,eax | 
| 5edf3366 | 894dfc | mov dword ptr [ebp-4],ecx | 
| 5edf3369 | 85c9 | test ecx,ecx | 
| 5edf336b | 7508 | jne AcroRd32!AX_PDXlateToHostEx+0x25e147 (5edf3375) | 
| 5edf336d | 6a03 | push 3 | 
| 5edf336f | 58 | pop eax | 
| 5edf3370 | e917010000 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e25e (5edf348c) | 
| 5edf3375 | 56 | push esi | 
| 5edf3376 | 33f6 | xor esi,esi | 
| 5edf3378 | 57 | push edi | 
| 5edf3379 | 8bfe | mov edi,esi | 
| 5edf337b | 397314 | cmp dword ptr [ebx+14h],esi | 
| 5edf337e | 0f86df000000 | jbe AcroRd32!AX_PDXlateToHostEx+0x25e235 (5edf3463) | 
| 5edf3384 | 8b4318 | mov eax,dword ptr [ebx+18h] | 
| 5edf3387 | 8b04b8 | mov eax,dword ptr [eax+edi*4] | 
| 5edf338a | 397040 | cmp dword ptr [eax+40h],esi | 
| 5edf338d | 0f84c6000000 | je AcroRd32!AX_PDXlateToHostEx+0x25e22b (5edf3459) | 
| 5edf3393 | 66397024 | cmp word ptr [eax+24h],si | 
| 5edf3397 | 0f85af000000 | jne AcroRd32!AX_PDXlateToHostEx+0x25e21e (5edf344c) | 
| 5edf339d | 89482c | mov dword ptr [eax+2Ch],ecx | 
| 5edf33a0 | 8b4318 | mov eax,dword ptr [ebx+18h] | 
| 5edf33a3 | 8b0cb8 | mov ecx,dword ptr [eax+edi*4] | 
| 5edf33a6 | 0fb64104 | movzx eax,byte ptr [ecx+4] | 
| 5edf33aa | 83f827 | cmp eax,27h | 
| 5edf33ad | 7f55 | jg AcroRd32!AX_PDXlateToHostEx+0x25e1d6 (5edf3404) | 
| 5edf33af | 744c | je AcroRd32!AX_PDXlateToHostEx+0x25e1cf (5edf33fd) | 
| 5edf33b1 | 83f814 | cmp eax,14h | 
| 5edf33b4 | 7f36 | jg AcroRd32!AX_PDXlateToHostEx+0x25e1be (5edf33ec) | 
| 5edf33b6 | 742d | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) | 
| 5edf33b8 | 2bc6 | sub eax,esi | 
| 5edf33ba | 7422 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b0 (5edf33de) | 
| 5edf33bc | 83e804 | sub eax,4 | 
| 5edf33bf | 7413 | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) | 
| 5edf33c1 | 48 | dec eax | 
| 5edf33c2 | 48 | dec eax | 
| 5edf33c3 | 740f | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) | 
| 5edf33c5 | 48 | dec eax | 
| 5edf33c6 | 740c | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) | 
| 5edf33c8 | 83e809 | sub eax,9 | 
| 5edf33cb | 757c | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) | 
| 5edf33cd | e80f150100 | call AcroRd32!CTJPEGRect::operator=+0x48c0 (5ee048e1) | 
| 5edf33d2 | eb71 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf33d4 | 56 | push esi | 
| 5edf33d5 | 56 | push esi | 
| 5edf33d6 | 56 | push esi | 
| 5edf33d7 | e8100a0100 | call AcroRd32!CTJPEGRect::operator=+0x3dcb (5ee03dec) | 
| 5edf33dc | eb67 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf33de | e879ec0000 | call AcroRd32!CTJPEGRect::operator=+0x203b (5ee0205c) | 
| 5edf33e3 | eb60 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf33e5 | e85d170100 | call AcroRd32!CTJPEGRect::operator=+0x4b26 (5ee04b47) | 
| 5edf33ea | eb59 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf33ec | 83e816 | sub eax,16h | 
| 5edf33ef | 74f4 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) | 
| 5edf33f1 | 48 | dec eax | 
| 5edf33f2 | 74f1 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) | 
| 5edf33f4 | 83e80d | sub eax,0Dh | 
| 5edf33f7 | 7404 | je AcroRd32!AX_PDXlateToHostEx+0x25e1cf (5edf33fd) | 
| 5edf33f9 | 48 | dec eax | 
| 5edf33fa | 48 | dec eax | 
| 5edf33fb | 754c | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) | 
| 5edf33fd | e8211f0100 | call AcroRd32!CTJPEGRect::operator=+0x5302 (5ee05323) // call | 
| 5edf3402 | eb41 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) // return address | 
| 5edf3404 | 83f832 | cmp eax,32h | 
| 5edf3407 | 7f28 | jg AcroRd32!AX_PDXlateToHostEx+0x25e203 (5edf3431) | 
| 5edf3409 | 741f | je AcroRd32!AX_PDXlateToHostEx+0x25e1fc (5edf342a) | 
| 5edf340b | 83e828 | sub eax,28h | 
| 5edf340e | 7413 | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) | 
| 5edf3410 | 48 | dec eax | 
| 5edf3411 | 48 | dec eax | 
| 5edf3412 | 740f | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) | 
| 5edf3414 | 48 | dec eax | 
| 5edf3415 | 740c | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) | 
| 5edf3417 | 83e805 | sub eax,5 | 
| 5edf341a | 752d | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) | 
| 5edf341c | e8b6e10000 | call AcroRd32!CTJPEGRect::operator=+0x15b6 (5ee015d7) | 
| 5edf3421 | eb22 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf3423 | e8d8200100 | call AcroRd32!CTJPEGRect::operator=+0x54df (5ee05500) | 
| 5edf3428 | eb1b | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf342a | e862000000 | call AcroRd32!AX_PDXlateToHostEx+0x25e263 (5edf3491) | 
| 5edf342f | eb14 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf3431 | 83e833 | sub eax,33h | 
| 5edf3434 | 740d | je AcroRd32!AX_PDXlateToHostEx+0x25e215 (5edf3443) | 
| 5edf3436 | 48 | dec eax | 
| 5edf3437 | 7410 | je AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) | 
| 5edf3439 | 48 | dec eax | 
| 5edf343a | 750d | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) | 
| 5edf343c | e8a8220100 | call AcroRd32!CTJPEGRect::operator=+0x56c8 (5ee056e9) | 
| 5edf3441 | eb02 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) | 
| 5edf3443 | 8bc6 | mov eax,esi | 
| 5edf3445 | 85c0 | test eax,eax | 
| 5edf3447 | 7541 | jne AcroRd32!AX_PDXlateToHostEx+0x25e25c (5edf348a) | 
| 5edf3449 | 8b4dfc | mov ecx,dword ptr [ebp-4] | 
| 5edf344c | 8b4318 | mov eax,dword ptr [ebx+18h] | 
| 5edf344f | 33d2 | xor edx,edx | 
| 5edf3451 | 42 | inc edx | 
| 5edf3452 | 8b04b8 | mov eax,dword ptr [eax+edi*4] | 
| 5edf3455 | 66895024 | mov word ptr [eax+24h],dx | 
| 5edf3459 | 47 | inc edi | 
| 5edf345a | 3b7b14 | cmp edi,dword ptr [ebx+14h] | 
| 5edf345d | 0f8221ffffff | jb AcroRd32!AX_PDXlateToHostEx+0x25e156 (5edf3384) | 
| 5edf3463 | 51 | push ecx | 
| 5edf3464 | e8b5c7a3ff | call AcroRd32!AcroWinMainSandbox+0x5c9a (5e82fc1e) | 
| 5edf3469 | 59 | pop ecx | 
| 5edf346a | 39730c | cmp dword ptr [ebx+0Ch],esi | 
| 5edf346d | 7619 | jbe AcroRd32!AX_PDXlateToHostEx+0x25e25a (5edf3488) | 
| 5edf346f | 8bfe | mov edi,esi | 
| 5edf3471 | 8b4b10 | mov ecx,dword ptr [ebx+10h] | 
| 5edf3474 | 03cf | add ecx,edi | 
| 5edf3476 | e861e20000 | call AcroRd32!CTJPEGRect::operator=+0x16bb (5ee016dc) | 
| 5edf347b | 85c0 | test eax,eax | 
| 5edf347d | 750b | jne AcroRd32!AX_PDXlateToHostEx+0x25e25c (5edf348a) | 
| Loaded symbol image file | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | 
| Image path | AcroRd32.exe | 
| Image name | AcroRd32.exe | 
| Timestamp | Fri May 11 00:19:40 2018 (5AF4C57C) | 
| CheckSum | 0022F148 | 
| ImageSize | 00230000 | 
| File version | 18.11.20040.19174 | 
| Product version | 18.11.20040.19174 | 
| File flags | 0 (Mask 3F) | 
| File OS | 50004 CE Win32 | 
| File type | 1.0 App | 
| File date | 00000000.00000000 | 
| Translations | 0409.04e4 | 
| CompanyName | Adobe Systems Incorporated | 
| ProductName | Adobe Acrobat Reader DC | 
| OriginalFilename | AcroRd32.exe | 
| ProductVersion | 18.11.20040.281318 | 
| FileVersion | 18.11.20040.281318 | 
| FileDescription | Adobe Acrobat Reader DC | 
| LegalCopyright | Copyright 1984-2017 Adobe Systems Incorporated and its licensors. All rights reserved. | 
| Loaded symbol image file | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll | 
| Image path | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll | 
| Image name | AcroRd32.dll | 
| Timestamp | Fri May 11 00:19:00 2018 (5AF4C554) | 
| CheckSum | 016EAE0A | 
| ImageSize | 01722000 | 
| File version | 18.11.20040.19174 | 
| Product version | 18.11.20040.19174 | 
| File flags | 0 (Mask 3F) | 
| File OS | 50004 CE Win32 | 
| File type | 2.0 Dll | 
| File date | 00000000.00000000 | 
| Translations | 0409.04e4 |