Adobe Acrobat Reader CVE-2025-64786

User must explicitly interact with the cryptographic signature embedded in the malicious PDF - this includes viewing signature properties, initiating signature verification, or responding to a signature validation dialog. The PDF must be on the local system where Acrobat Reader or Acrobat is installed. No network access is required; the attack is purely local (AV:L). The vulnerability does not require elevated privileges (PR:N) or affect multi-user systems differently. Non-Windows platforms are in scope per CPE generality. Exploitation is limited to signature verification bypass; an attacker cannot execute arbitrary code, read encrypted file contents, or cause denial of service. The user must have Acrobat Reader or Acrobat already installed and configured to handle PDFs.

The risk profile is moderate but not critical. The CVSS score of 3.3 (low severity) reflects several limiting factors: local attack vector (AV:L) requiring an attacker-controlled PDF on the target system, requirement for user interaction (UI:R) to process the malicious signature, and limited impact (integrity only, no confidentiality or availability impact). However, the CVSS vector does not fully capture the real-world threat model. The actual scenario involves social engineering - sending a crafted PDF via email or file sharing - which is a proven attack delivery method. The authentication bypass tag in the vulnerability classification suggests this could chain with other attacks if an organization relies on digital signatures for document authorization workflows. EPSS data is not provided, limiting exploitation probability assessment. Patch availability is confirmed per the Adobe advisory reference. The low CVSS should not be interpreted as low priority for organizations using digital signatures for compliance, legal, or contractual document authentication; for general users opening untrusted PDFs, the risk is minimal.

An attacker crafts a PDF document with an invalid or spoofed digital signature that bypasses Adobe Reader's signature verification logic. The attacker emails the PDF to a target user or posts it on a file-sharing platform, social engineering the user to open and interact with the signature field. When the user views the signature properties or validates the document, Adobe Reader incorrectly accepts the forged signature, allowing the attacker's subsequent modifications to the PDF (text, form fields, annotations) to be treated as authenticated, potentially used in a business process that relies on signature validation.