Acrobat CVE-2025-43577

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates: local attack vector (must be on affected system or via file delivery), low attack complexity (no special conditions required once file is opened), no privilege requirements, user interaction required (opening malicious file), unchanged scope, and high impact on confidentiality, integrity, and availability. The 7.8 score reflects high severity. Real-world risk is amplified by: (1) Acrobat Reader's ubiquitous deployment in enterprises, (2) user tendency to open email attachments and downloaded PDFs, (3) the low attack complexity once user interaction occurs, (4) multiple affected versions across release tracks increasing patch fragmentation. However, the requirement for user interaction to open a malicious file provides a friction point. EPSS probability data would clarify whether this is being actively exploited in the wild; KEV (Known Exploited Vulnerabilities) catalog inclusion would indicate active weaponization. The presence of patches for multiple version branches suggests Adobe has triaged this as critical. This merits immediate patching priority despite requiring user interaction, as targeted delivery of malicious PDFs to specific users or organizations remains a proven attack vector.

An attacker crafts a malicious PDF file containing a specially constructed object or embedded media stream that triggers a Use After Free condition in Acrobat Reader's rendering or parsing engine. The attacker distributes this PDF via spear-phishing email (to targeted users) or compromised website downloads, or uploads it to a document sharing platform. When a victim user opens the PDF in Acrobat Reader (a common, expected action for PDF files), the UAF is triggered during PDF parsing. The attacker's payload in the freed memory region is executed with the user's privileges, allowing data exfiltration (keylogging, clipboard capture, stealing documents), lateral movement within the network (if user has elevated access), or deployment of secondary malware (ransomware, backdoor). The attack requires no special system conditions and succeeds immediately upon file opening, making it a high-confidence attack for threat actors with access to target users' email or common download sources. No POC details are available in the provided data; its existence should be verified through threat intelligence feeds and exploit databases.