EUVD-2025-17826Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Use After Free vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges when a victim opens a malicious PDF file. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. This vulnerability requires user interaction but presents high severity due to memory corruption leading to code execution, with exploitation probability and active exploitation status dependent on available public exploits.
Technical ContextAI
The vulnerability exploits a Use After Free (CWE-416) condition in Adobe Acrobat Reader's PDF processing engine. CWE-416 occurs when software references memory that has been freed, allowing attackers to manipulate freed memory regions to achieve code execution. In this context, the PDF parsing logic likely frees object references prematurely while other components continue to operate on those memory addresses. When processing maliciously crafted PDF files, an attacker can trigger this race condition or logic flaw to overwrite freed memory with executable code or manipulate object pointers. The vulnerability affects Adobe's core rendering engine used across multiple Acrobat Reader versions (CPE would include cpe:2.3:a:adobe:acrobat_reader:*). The local attack vector (AV:L) indicates the malicious file must be opened locally, typically via email attachment, web download, or file-sharing mechanism.
RemediationAI
Immediate actions: (1) Update Adobe Acrobat Reader to patched versions when released by Adobe; vendors typically issue security updates within 30 days of CVE publication. Monitor Adobe Security Bulletins (adobe.com/security) for official patch availability and version numbers. (2) Interim mitigations while awaiting patches: disable PDF opening in email clients and require users to download and manually open PDFs from trusted sources; disable JavaScript execution within Acrobat Reader (Edit > Preferences > JavaScript > Disable JavaScript); deploy sandboxing or application whitelisting to limit Reader process capabilities; restrict file execution from user-writable directories. (3) Network controls: block suspicious PDF attachments at email gateways using threat intelligence signatures once public exploits emerge; monitor for suspicious Acrobat Reader process behavior (memory corruption attempts, unusual child process spawning). (4) Enterprise: prioritize patching for versions 24.x and 25.x (current release lines) first, then address legacy 20.x installations. Establish a baseline for Acrobat Reader version compliance and deploy patches via existing software distribution mechanisms (WSUS, Jamf, Linux package managers).
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today