EUVD-2025-17826
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Analysis
Use After Free vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges when a victim opens a malicious PDF file. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. This vulnerability requires user interaction but presents high severity due to memory corruption leading to code execution, with exploitation probability and active exploitation status dependent on available public exploits.
Technical Context
The vulnerability exploits a Use After Free (CWE-416) condition in Adobe Acrobat Reader's PDF processing engine. CWE-416 occurs when software references memory that has been freed, allowing attackers to manipulate freed memory regions to achieve code execution. In this context, the PDF parsing logic likely frees object references prematurely while other components continue to operate on those memory addresses. When processing maliciously crafted PDF files, an attacker can trigger this race condition or logic flaw to overwrite freed memory with executable code or manipulate object pointers. The vulnerability affects Adobe's core rendering engine used across multiple Acrobat Reader versions (CPE would include cpe:2.3:a:adobe:acrobat_reader:*). The local attack vector (AV:L) indicates the malicious file must be opened locally, typically via email attachment, web download, or file-sharing mechanism.
Affected Products
Adobe Acrobat Reader (all platforms): versions 24.001.30235 and earlier, 20.005.30763 and earlier, and 25.001.20521 and earlier. CPE identifiers affected include: cpe:2.3:a:adobe:acrobat_reader:24.001.30235:*:*:*:*:*:*:*, cpe:2.3:a:adobe:acrobat_reader:20.005.30763:*:*:*:*:*:*:*, cpe:2.3:a:adobe:acrobat_reader:25.001.20521:*:*:*:*:*:*:* and all earlier versions within these release branches. Impacts Windows, macOS, and Linux distributions of Acrobat Reader. Note: The presence of three distinct version branches (24.x, 20.x, 25.x) suggests Adobe maintains multiple product release cycles and extended support versions, requiring patching across all branches. Enterprise deployments using legacy versions (20.x) are particularly at risk if update policies lag current versions.
Remediation
Immediate actions: (1) Update Adobe Acrobat Reader to patched versions when released by Adobe; vendors typically issue security updates within 30 days of CVE publication. Monitor Adobe Security Bulletins (adobe.com/security) for official patch availability and version numbers. (2) Interim mitigations while awaiting patches: disable PDF opening in email clients and require users to download and manually open PDFs from trusted sources; disable JavaScript execution within Acrobat Reader (Edit > Preferences > JavaScript > Disable JavaScript); deploy sandboxing or application whitelisting to limit Reader process capabilities; restrict file execution from user-writable directories. (3) Network controls: block suspicious PDF attachments at email gateways using threat intelligence signatures once public exploits emerge; monitor for suspicious Acrobat Reader process behavior (memory corruption attempts, unusual child process spawning). (4) Enterprise: prioritize patching for versions 24.x and 25.x (current release lines) first, then address legacy 20.x installations. Establish a baseline for Acrobat Reader version compliance and deploy patches via existing software distribution mechanisms (WSUS, Jamf, Linux package managers).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today