Acrobat Reader Dc
Monthly
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution at current-user privilege level when a victim opens a crafted PDF or supported file format. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383 across all supported platforms, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation in the wild has been identified at the time of this analysis, but Adobe Acrobat's ubiquity in enterprise document workflows makes this a credible phishing or spear-phishing vehicle.
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Integer overflow in Adobe Acrobat Reader and Acrobat (all editions through 26.002.21900) and Acrobat 2024 (through 24.001.30383) enables arbitrary code execution within the context of the victim's user account. The flaw is triggered when a user opens a specially crafted PDF file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, but the high CIA impact and wide deployment footprint make patching a priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.
Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Double Free memory corruption in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the victim user when a malicious PDF or document file is opened. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. Adobe PSIRT has published advisory APSB26-141 confirming the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.
Arbitrary code execution in Adobe Acrobat and Acrobat Reader versions 24.001.30307 and earlier stems from a use-after-free memory vulnerability triggered when users open specially crafted files. An attacker can achieve code execution with the privileges of the current user, though exploitation requires victim interaction. No patch is currently available for affected versions.
Arbitrary code execution in Adobe Acrobat Reader and Acrobat (versions 24.001.30307 and earlier) via a use-after-free vulnerability requires victims to open a malicious file. Local attackers can exploit this to execute code with the privileges of the current user. No patch is currently available.
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe Acrobat Reader and Acrobat 2024 allows unauthorized write access by bypassing document-level security restrictions when a victim opens a specially crafted PDF file. The CVSS scope-change indicator (S:C) signals the unauthorized write can escape the Acrobat process boundary and affect components outside the application itself, amplifying real-world impact beyond the medium base score. No public exploit has been identified and the vulnerability is not currently listed in the CISA KEV catalog.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper certificate validation in Adobe Acrobat Reader DC versions 24.001.30307 and earlier allows local attackers to forge digital signatures by spoofing signer identity, bypassing security features that users rely on for document verification. This attack requires user interaction and affects multiple Adobe products including Acrobat DC. No patch is currently available.
Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader that allows arbitrary code execution with the privileges of the current user. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple release tracks. Exploitation requires user interaction (opening a malicious PDF file), but the high CVSS score of 7.8 and local attack vector indicate significant real-world risk; KEV and active exploitation status should be confirmed from official sources.
A remote code execution vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation.
CVE-2025-43575 is an out-of-bounds write vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with high integrity and confidentiality impact. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. Exploitation requires user interaction (opening a malicious PDF), but once triggered, allows code execution in the context of the current user with no privilege elevation needed.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader affecting versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier that enables arbitrary code execution with the privileges of the current user. The vulnerability requires user interaction (opening a malicious PDF file) but has a high CVSS score of 7.8 due to the severity of potential code execution impact. Without confirmed KEV listing or public POC data provided, this represents a significant but not yet confirmed active threat.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with high privilege context on affected systems. The vulnerability impacts multiple versions across different release branches (24.001.30235, 20.005.30763, 25.001.20521 and earlier), requiring only user interaction to trigger exploitation via malicious PDF files. With a CVSS score of 7.8 and no privilege escalation required, this represents a significant risk to enterprise and consumer users relying on Acrobat Reader for document handling.
Use After Free vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges when a victim opens a malicious PDF file. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. This vulnerability requires user interaction but presents high severity due to memory corruption leading to code execution, with exploitation probability and active exploitation status dependent on available public exploits.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to. Rated high severity (CVSS 7.0). No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU). Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution at current-user privilege level when a victim opens a crafted PDF or supported file format. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383 across all supported platforms, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation in the wild has been identified at the time of this analysis, but Adobe Acrobat's ubiquity in enterprise document workflows makes this a credible phishing or spear-phishing vehicle.
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Integer overflow in Adobe Acrobat Reader and Acrobat (all editions through 26.002.21900) and Acrobat 2024 (through 24.001.30383) enables arbitrary code execution within the context of the victim's user account. The flaw is triggered when a user opens a specially crafted PDF file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, but the high CIA impact and wide deployment footprint make patching a priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.
Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Double Free memory corruption in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the victim user when a malicious PDF or document file is opened. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. Adobe PSIRT has published advisory APSB26-141 confirming the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.
Arbitrary code execution in Adobe Acrobat and Acrobat Reader versions 24.001.30307 and earlier stems from a use-after-free memory vulnerability triggered when users open specially crafted files. An attacker can achieve code execution with the privileges of the current user, though exploitation requires victim interaction. No patch is currently available for affected versions.
Arbitrary code execution in Adobe Acrobat Reader and Acrobat (versions 24.001.30307 and earlier) via a use-after-free vulnerability requires victims to open a malicious file. Local attackers can exploit this to execute code with the privileges of the current user. No patch is currently available.
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe Acrobat Reader and Acrobat 2024 allows unauthorized write access by bypassing document-level security restrictions when a victim opens a specially crafted PDF file. The CVSS scope-change indicator (S:C) signals the unauthorized write can escape the Acrobat process boundary and affect components outside the application itself, amplifying real-world impact beyond the medium base score. No public exploit has been identified and the vulnerability is not currently listed in the CISA KEV catalog.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Untrusted Search Path exploitation in Adobe Acrobat and Acrobat Reader allows a local attacker who already holds high privileges to gain unauthorized read access to sensitive confidential data under specific, attacker-uncontrollable environmental conditions. Affected products include Acrobat 2024 (≤24.001.30383), Acrobat Reader, and Adobe Acrobat (both ≤26.002.21900), per EUVD-2026-74105 and Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis; exploitation mandates a victim open a malicious file and requires conditions beyond the attacker's direct control.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper certificate validation in Adobe Acrobat Reader DC versions 24.001.30307 and earlier allows local attackers to forge digital signatures by spoofing signer identity, bypassing security features that users rely on for document verification. This attack requires user interaction and affects multiple Adobe products including Acrobat DC. No patch is currently available.
Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader that allows arbitrary code execution with the privileges of the current user. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple release tracks. Exploitation requires user interaction (opening a malicious PDF file), but the high CVSS score of 7.8 and local attack vector indicate significant real-world risk; KEV and active exploitation status should be confirmed from official sources.
A remote code execution vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation.
CVE-2025-43575 is an out-of-bounds write vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with high integrity and confidentiality impact. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. Exploitation requires user interaction (opening a malicious PDF), but once triggered, allows code execution in the context of the current user with no privilege elevation needed.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader affecting versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier that enables arbitrary code execution with the privileges of the current user. The vulnerability requires user interaction (opening a malicious PDF file) but has a high CVSS score of 7.8 due to the severity of potential code execution impact. Without confirmed KEV listing or public POC data provided, this represents a significant but not yet confirmed active threat.
Use After Free (UAF) vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with high privilege context on affected systems. The vulnerability impacts multiple versions across different release branches (24.001.30235, 20.005.30763, 25.001.20521 and earlier), requiring only user interaction to trigger exploitation via malicious PDF files. With a CVSS score of 7.8 and no privilege escalation required, this represents a significant risk to enterprise and consumer users relying on Acrobat Reader for document handling.
Use After Free vulnerability in Adobe Acrobat Reader that enables arbitrary code execution with user-level privileges when a victim opens a malicious PDF file. Affected versions include 24.001.30235, 20.005.30763, 25.001.20521 and earlier across multiple product lines. This vulnerability requires user interaction but presents high severity due to memory corruption leading to code execution, with exploitation probability and active exploitation status dependent on available public exploits.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to. Rated high severity (CVSS 7.0). No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU). Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.