Adobe Acrobat Reader
CVE-2025-64899
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation (AV:L, UI:R), no auth to open a file (PR:N), and Adobe-stated code execution in user context yields C/I/A:H with S:U.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Acrobat and Acrobat Reader (versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier across Classic and Continuous tracks) can lead to arbitrary code execution in the context of the current user when a crafted PDF file is opened. The attack vector is local (AV:L) and requires user interaction (UI:R) - no authentication (PR:N) or special configuration is needed, but the victim must be socially engineered into opening a malicious file, and code runs only at the user's privilege level (S:U). No public exploit code or confirmed active exploitation is identified at time of analysis; this is a genuine patch-priority issue for endpoints rather than an emergency for internet-facing infrastructure.
Technical ContextAI
The vulnerability is an out-of-bounds read (CWE-125) that occurs during parsing of a specially crafted PDF file by Adobe Acrobat or Acrobat Reader. In an out-of-bounds read, the parser follows a malformed length or index value and reads memory beyond the end of an allocated buffer, which can leak information or, depending on memory layout and adjacent data, be chained into code execution. Affected CPEs show the flaw touches both the Classic tracks (Acrobat and Acrobat Reader) and the Continuous tracks (Acrobat DC and Acrobat Reader DC), meaning desktop deployments on Windows and macOS are in scope. Exploitation is gated by user interaction and the local attack vector; the CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no privileges are needed before the file is opened, but the victim must open the file and the resulting code runs as the current user without privilege escalation. Sandboxing features such as Protected Mode can constrain impact.
RemediationAI
Patch available per vendor advisory: Adobe APSB25-119 (https://helpx.adobe.com/security/products/acrobat/apsb25-119.html) contains the fixed release mapping for each track. Update Acrobat and Acrobat Reader to the latest fixed release for your deployment - Classic or Continuous - following the advisory, since no exact patched version string is present in the supplied data. Until updates are applied, enable Protected Mode/sandboxing where available (side effect: some PDF features or third-party integrations may break), restrict users from opening PDF files from untrusted sources, block or quarantine PDF attachments at email and web gateways (side effect: legitimate PDF workflow disruption), and reinforce user awareness about social engineering because exploitation requires a victim to open the crafted file. Because the attack is local and needs user interaction, prioritizing endpoint patch cycles is appropriate; there is no need for emergency internet-facing mitigation.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today