What is the CVSS score of CVE-2025-64785?

CVE-2025-64785 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe Acrobat Reader are affected by CVE-2025-64785?

Adobe Acrobat Reader DC and Acrobat DC (versions 25.001.20982, 24.001.30273, and 20.005.30803 and earlier) contain a DLL search path vulnerability enabling arbitrary code execution when users open…

How to fix or mitigate CVE-2025-64785?

Within 24 hours: Inventory all Adobe Acrobat Reader DC and Acrobat DC installations and identify affected versions (≤25.001.20982, ≤24.001.30273, ≤20.005.30803). Within 7 days: Deploy Adobe security updates per APSB25-119 to all affected systems-apply version 25.002 or later for v25.x, 24.002 or later for v24.x, and 20.006 or later for v20.x. Within 30 days: Verify 100% patching compliance via endpoint management tools; conduct user awareness training emphasizing suspicious PDF attachments and sources.

Adobe Acrobat Reader CVE-2025-64785

HIGH

Untrusted Search Path (CWE-426)

2025-12-09 psirt@adobe.com

RCE Adobe

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 03:30 vuln.today

DescriptionCVE.org

Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that the user needs to open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe Acrobat Reader DC and Acrobat DC (all editions through versions 25.001.20982, 24.001.30273, and 20.005.30803) occurs when malicious files manipulate the application's DLL search path. Attackers achieve full code execution with current user privileges through local attack requiring social engineering to open a crafted PDF or related file. Adobe confirms the vulnerability in security bulletin APSB25-119 with patches released for all affected product lines. EPSS data not provided, but the local vector with required user interaction (AV:L/UI:R) and lack of CISA KEV listing suggest lower probability of widespread automated exploitation compared to remote vulnerabilities, though targeted attacks via phishing remain viable.

Technical ContextAI

CWE-426 Untrusted Search Path vulnerabilities occur when applications use relative paths or inadequately controlled search mechanisms to load external resources like dynamic libraries (DLLs on Windows). Adobe Acrobat's implementation allows attackers to exploit Windows DLL search order by placing malicious libraries in directories the application searches before system directories. The CPE data reveals impact across multiple product editions: Acrobat Reader DC Continuous track (consumer auto-update), Acrobat DC Continuous, and Classic track versions (enterprise managed updates) of both Reader and full Acrobat. The CVSS vector AV:L indicates local file system access is the attack vector, meaning the malicious DLL must be placed on the target system alongside the weaponized file. This differs from remote code execution where initial access is gained over the network, requiring attackers to first deliver both the trigger file and malicious library through phishing, removable media, or existing file-write access.

RemediationAI

Apply Adobe's vendor-released patches per security bulletin APSB25-119 available at https://helpx.adobe.com/security/products/acrobat/apsb25-119.html, which provides updated versions addressing this and related vulnerabilities across all affected product tracks. For Continuous track deployments (consumer auto-update channel), patches deploy automatically when users restart the application. For Classic track deployments (enterprise managed updates), administrators must deploy updates through existing software distribution mechanisms or Adobe's enterprise deployment tools. As compensating controls where immediate patching is not feasible, restrict PDF opening to trusted sources only through email gateway policies that quarantine or sandbox PDFs from external senders, deploy application whitelisting to prevent unauthorized DLL loading from user-writable directories (though this may break legitimate plugins and requires testing), and enable Protected Mode/AppContainer sandboxing in Acrobat preferences to limit code execution impact, noting this defense-in-depth control may not fully mitigate search path manipulation. User awareness training to avoid opening PDFs from unknown sources provides additional risk reduction but should not replace patching as primary remediation.