Acrobat CVE-2025-43574

CVSS 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates: Local attack vector (file-based), Low complexity, No privileges required, but User Interaction required. The high confidentiality, integrity, and availability impact scores reflect code execution capability. The presence of user interaction (UI:R) moderates risk compared to network-exploitable vulnerabilities, but the straightforward attack complexity (AC:L) means exploitation is feasible once a victim opens a crafted file. Without EPSS probability data, KEV confirmation, or public POC availability provided in this analysis, the real-world urgency depends on whether Adobe has issued patches and whether threat actors are known to be exploiting this. The combination of UAF severity with multi-version impact suggests moderate to high priority for patching, particularly in environments where users regularly open untrusted PDFs (legal, HR, finance sectors). Organizations should treat this as a critical remediation target pending patch availability confirmation.

An attacker crafts a malicious PDF document that triggers the Use After Free condition in Acrobat Reader's PDF rendering engine. The attacker emails this PDF to a target user or hosts it on a compromised website. When the victim opens the PDF in Adobe Acrobat Reader (any affected version), the UAF vulnerability is triggered: a critical object is prematurely freed during PDF parsing, and subsequent memory operations dereference the freed pointer, allowing the attacker's payload to overwrite freed memory or execute shellcode. The resulting arbitrary code execution runs with the victim user's privileges, enabling data theft, system compromise, lateral movement, or further attacks. No special privileges or network access are required from the attacker's perspective; only social engineering to convince the user to open the file. Public POC or active exploitation status is not confirmed in provided data, but the technical simplicity of UAF exploitation (AC:L) suggests weaponization is likely if the vulnerability is disclosed publicly.