EUVD-2025-17827CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Use After Free (UAF) vulnerability in Adobe Acrobat Reader that allows arbitrary code execution with the privileges of the current user. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple release tracks. Exploitation requires user interaction (opening a malicious PDF file), but the high CVSS score of 7.8 and local attack vector indicate significant real-world risk; KEV and active exploitation status should be confirmed from official sources.
Technical ContextAI
This vulnerability is classified as CWE-416 (Use After Free), a memory safety issue where the application continues to reference memory that has been freed by the program. In Adobe Acrobat Reader's PDF parsing engine, this likely occurs during the processing of maliciously crafted PDF objects or embedded content (JavaScript, media, form fields). The UAF condition allows an attacker to overwrite freed memory with controlled data, achieving arbitrary code execution in the context of the Reader process. Affected CPE ranges include Adobe Acrobat Reader DC and continuous release tracks (versions 24.x, 25.x, and legacy 20.x branches), suggesting the vulnerability spans multiple code paths across different maintenance versions and may involve shared PDF processing libraries.
RemediationAI
Immediate actions: (1) Update Adobe Acrobat Reader to versions NEWER than 24.001.30235 (likely 24.002.x or later), newer than 25.001.20521 (likely 25.002.x or later), or newer than 20.005.30763 (if applicable). Check Adobe's official security update page for specific patch versions released after this CVE announcement. (2) Enable automatic updates in Acrobat Reader preferences (Edit > Preferences > Security > Check for Updates). (3) Interim mitigations if immediate patching is not feasible: disable JavaScript execution in PDF files (Edit > Preferences > Security > Enhanced Security), restrict file associations for PDF files to prevent automatic opening, and implement email filtering to block suspicious PDF attachments. (4) User education: advise users to be cautious opening PDF files from untrusted sources, especially unexpected email attachments. (5) Endpoint detection: deploy behavioral monitoring for abnormal process execution spawned from Reader processes (parent: AdobeReader.exe/acroread).
Share
External POC / Exploit Code
Leaving vuln.today