CVE-2024-20765
📋 TL;DR
A use-after-free vulnerability in Adobe Acrobat Reader allows arbitrary code execution when a user opens a malicious PDF file. This affects users running vulnerable versions of Acrobat Reader on any operating system. Successful exploitation gives attackers the same privileges as the current user.
💻 Affected Systems
- Adobe Acrobat Reader DC
- Adobe Acrobat Reader
📦 What is this software?
Acrobat by Adobe
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malicious actor gains control of the user's system through a phishing email containing a malicious PDF, leading to data exfiltration or credential theft.
If Mitigated
User opens PDF in sandboxed environment or protected view, limiting damage to isolated container without system access.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.005.30554 or 23.008.20476
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest version. 4. Restart computer after installation.
🔧 Temporary Workarounds
Enable Protected View
windowsForce all PDFs to open in Protected View mode which isolates the document in a sandbox
Edit > Preferences > Security (Enhanced) > Enable Protected View at startup
Disable JavaScript in PDFs
allPrevent JavaScript execution in PDF files which may be used in exploitation chains
Edit > Preferences > JavaScript > Uncheck 'Enable Acrobat JavaScript'
🧯 If You Can't Patch
- Disable Adobe Acrobat Reader and use alternative PDF viewers
- Implement application whitelisting to block Acrobat Reader execution
🔍 How to Verify
Check if Vulnerable:
Check Help > About Adobe Acrobat Reader DC. If version is 20.005.30539 or earlier OR 23.008.20470 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Adobe Acrobat Reader DC" get versionVerify Fix Applied:
Verify version is 20.005.30554 or later OR 23.008.20476 or later after update.📡 Detection & Monitoring
Log Indicators:
- Acrobat crash logs with memory access violations
- Unexpected child processes spawned from Acrobat.exe
Network Indicators:
- Outbound connections from Acrobat.exe to unknown IPs
- DNS requests for suspicious domains after PDF opening
SIEM Query:
process_name:"Acrobat.exe" AND (event_id:1 OR parent_process_name:"Acrobat.exe")