EUVD-2025-17826CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Use After Free vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges when a victim opens a malicious PDF file. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. This vulnerability requires user interaction but presents high severity due to memory corruption leading to code execution, with exploitation probability and active exploitation status dependent on available public exploits.
Technical ContextAI
The vulnerability exploits a Use After Free (CWE-416) condition in Adobe Acrobat Reader's PDF processing engine. CWE-416 occurs when software references memory that has been freed, allowing attackers to manipulate freed memory regions to achieve code execution. In this context, the PDF parsing logic likely frees object references prematurely while other components continue to operate on those memory addresses. When processing maliciously crafted PDF files, an attacker can trigger this race condition or logic flaw to overwrite freed memory with executable code or manipulate object pointers. The vulnerability affects Adobe's core rendering engine used across multiple Acrobat Reader versions (CPE would include cpe:2.3:a:adobe:acrobat_reader:*). The local attack vector (AV:L) indicates the malicious file must be opened locally, typically via email attachment, web download, or file-sharing mechanism.
RemediationAI
Immediate actions: (1) Update Adobe Acrobat Reader to patched versions when released by Adobe; vendors typically issue security updates within 30 days of CVE publication. Monitor Adobe Security Bulletins (adobe.com/security) for official patch availability and version numbers. (2) Interim mitigations while awaiting patches: disable PDF opening in email clients and require users to download and manually open PDFs from trusted sources; disable JavaScript execution within Acrobat Reader (Edit > Preferences > JavaScript > Disable JavaScript); deploy sandboxing or application whitelisting to limit Reader process capabilities; restrict file execution from user-writable directories. (3) Network controls: block suspicious PDF attachments at email gateways using threat intelligence signatures once public exploits emerge; monitor for suspicious Acrobat Reader process behavior (memory corruption attempts, unusual child process spawning). (4) Enterprise: prioritize patching for versions 24.x and 25.x (current release lines) first, then address legacy 20.x installations. Establish a baseline for Acrobat Reader version compliance and deploy patches via existing software distribution mechanisms (WSUS, Jamf, Linux package managers).
Share
External POC / Exploit Code
Leaving vuln.today