Adobe Acrobat Reader CVE-2025-64787

Exploitation requires user interaction with a PDF document containing a crafted cryptographic signature (UI:R is mandatory per CVSS vector). The attack is limited to local access (AV:L), meaning the attacker must have the ability to place the malicious PDF on the target system or trick the user into opening it locally. The vulnerability specifically affects the signature verification subsystem - it is NOT exploitable against documents with properly formed signatures, only against deliberately malformed ones that the verification code fails to correctly validate. No special Acrobat configuration settings are required; default installations are vulnerable. The attack does not require authentication to the application. Exploitation is constrained to write-level access (I:L impact); the attacker cannot read confidential document content or execute arbitrary code.

This vulnerability presents minimal real-world risk despite being a security feature bypass. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U indicates local access is required with user interaction - a significant limiting factor. The impact is restricted to integrity (I:L) with no confidentiality or availability impact, meaning an attacker can only write to documents, not exfiltrate data or crash the system. The low CVSS score of 3.3 accurately reflects this constrained scope. However, the authentication bypass tag and JWT attack reference suggest the underlying issue may involve signature spoofing mechanisms that, while currently limited to local write access, could pose greater risk in enterprise scenarios where signed PDFs are critical for compliance or legal validity. Organizations relying on PDF signatures for document authenticity should prioritize patching, though the practical exploitation barrier (requiring local access and user interaction) means this is not an immediate critical threat. The gap between the CWE-347 classification (improper cryptographic verification) and the limited impact described warrants vendor clarification on whether signature verification is fully bypassed or only partially weakened.

A user receives a crafted PDF file via email or downloads one from a compromised website. The PDF appears to be signed (displaying a signature widget), but the signature uses improper cryptographic construction that bypasses Reader's verification logic. When the user opens the document, the malicious signature is accepted as valid despite failing proper cryptographic checks. The attacker then exploits this acceptance to programmatically insert content, annotations, or form field values into the document without triggering security warnings, effectively forging document modifications that appear signed and trusted.