Some researchers have blasted Adobe for poor programming practices, saying that its mistakes left Reader and Acrobat users at risk.
"This time Adobe gives a hand to the attacker," said Prevx researcher Marco Giuliani , talking about the failure to enable ASLR in icucnv36.dll. "Adobe could have easily prevented this type of exploit."
For others, the moment when Adobe launches its next version of Reader, which will include "sandboxing" technology to isolate application processes from one another and from the rest of the machine, won't come too soon.
"New stack overflow in Adobe Reader," said vulnerability researcher Charlie Miller on Twitter last week. "Dear Adobe, when you patch out of band every month, you don't have a patch cycle. Hurry with the sandbox."
Sandboxing is designed to stop malicious code from escaping an application to wreak havoc or infect the computer, or at least make it much more difficult for hackers to do so.
Adobe has not set a patch date for the Reader/Acrobat bug. The programs' next regularly-scheduled security update is slated for Oct. 12, but Adobe has pushed out emergency, or out-of-band, updates several times this year to fix flaws being actively exploited by attackers.
The last time Adobe released a rush patch was Aug. 19, three weeks after Miller talked about a Reader bug at the Black Hat security conference. Google security engineer Tavis Ormandy had privately reported the vulnerability to Adobe before Black Hat.
Microsoft's EMET 2.0 can be downloaded from the company's site .
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org .
Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.