What is the CVSS score of CVE-2025-64786?

CVE-2025-64786 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Acrobat Reader CVE-2025-64786

LOW

Improper Verification of Cryptographic Signature (CWE-347)

2025-12-09 psirt@adobe.com

Jwt Attack Authentication Bypass Adobe

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 03:30 vuln.today

DescriptionCVE.org

Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited unauthorized write access. Exploitation of this issue requires user interaction with a cryptographic signature.

AnalysisAI

Improper verification of cryptographic signatures in Adobe Acrobat Reader and Acrobat DC versions up to 24.001.30273, 25.001.20982, and 20.005.30803 allows local attackers to bypass security features and gain limited unauthorized write access to PDF documents. Exploitation requires user interaction with a malicious or specially crafted cryptographic signature embedded in a PDF file. No active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from inadequate validation of cryptographic signatures (CWE-347: Improper Verification of Cryptographic Signature) within Adobe's PDF signature verification subsystem. PDFs employ digital signatures to authenticate document origin and integrity; this flaw allows an attacker to craft a signature that fails proper cryptographic verification but is incorrectly accepted by the application. The affected products span Adobe Acrobat (classic track), Acrobat DC (continuous track), Acrobat Reader (classic track), and Acrobat Reader DC (continuous track), as identified by the CPE strings. The signature verification bypass enables unauthorized modification of PDF content despite the presence of a signature field, undermining the document authentication mechanism.

RemediationAI

Apply the security patch released by Adobe in bulletin APSB25-119 immediately. The exact patched versions depend on the product track: for classic track Acrobat and Reader, upgrade to versions after 24.001.30273 or 25.001.20982 (consult APSB25-119 for exact patched version numbers); for continuous track Acrobat DC and Reader DC, update to the latest release. As an interim compensating control, organizations should disable signature verification features if the functionality is not critical to workflows, though this may reduce document authenticity assurance. Users should also avoid opening PDF files from untrusted sources and disable the automatic signature validation prompt to prevent user interaction with malicious signatures. These mitigations reduce functionality and are temporary; patch deployment is the definitive fix. Refer to https://helpx.adobe.com/security/products/acrobat/apsb25-119.html for specific version numbers and deployment guidance.