EUVD-2025-17824
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Analysis
CVE-2025-43575 is an out-of-bounds write vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with high integrity and confidentiality impact. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. Exploitation requires user interaction (opening a malicious PDF), but once triggered, allows code execution in the context of the current user with no privilege elevation needed.
Technical Context
The vulnerability exists in Adobe Acrobat Reader's PDF parsing engine, specifically in memory handling functions that process embedded objects or content streams without proper bounds checking. CWE-787 (Out-of-bounds Write) indicates that the application writes data beyond the allocated buffer boundaries, potentially overwriting adjacent memory regions including the heap or stack. This occurs during PDF file parsing, affecting multiple versions across the 20.x, 24.x, and 25.x release branches (CPE patterns: cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*). The vulnerability is triggered through specially crafted PDF documents that exploit improper validation of object sizes or stream lengths during document rendering or processing.
Affected Products
Acrobat Reader (['25.001.20521 and earlier', '24.001.30235 and earlier', '20.005.30763 and earlier'])
Remediation
Patching: Update Adobe Acrobat Reader to versions newer than the affected releases: upgrade to 25.001.20522 or later, 24.001.30236 or later, or 20.005.30764 or later depending on deployment track.; priority: High Vendor Advisory: Consult Adobe Security Bulletin APSB25-XX (assumed numbering) for official patch availability and deployment guidance. Register affected systems with Adobe for vulnerability notifications.; priority: High Workaround (Temporary): Disable automatic PDF opening in email clients and web browsers; require manual user confirmation before opening PDFs from untrusted sources. Use sandbox or isolated environments for opening untrusted documents.; priority: Medium Detection & Monitoring: Monitor endpoint logs for abnormal Acrobat Reader process behavior (child process creation, network connections, memory access violations). Use host-based intrusion detection to flag PDF files with embedded executable content or suspicious object streams.; priority: Medium
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today