Collab.collectEmailInfo — CVE-2007-5659

CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument to the Collab.collectEmailInfo() JavaScript API. This was one of the earliest widely-exploited PDF JavaScript vulnerabilities. The rule requires either Collab.collectEmailInfo() with a quoted string at least 128 bytes long, or the decoded exploit-kit shape where JavaScript builds a %u0c0c heap spray and passes that sprayed string through the msg field of Collab.collectEmailInfo(). It also catches older variants that decode shellcode with unescape(), assemble a large version-dependent buffer, and pass that variable through msg, including annotation-/Subject staged payloads that are recovered before CVE matching. Plain short calls are not flagged. CISA KEV.