CVE-2024-34096
📋 TL;DR
Adobe Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier contain a use-after-free vulnerability that could allow arbitrary code execution when a user opens a malicious PDF file. This affects all users running vulnerable versions of Acrobat Reader on any operating system.
💻 Affected Systems
- Adobe Acrobat Reader
- Adobe Acrobat Reader DC
📦 What is this software?
Acrobat by Adobe
Acrobat by Adobe
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious PDF file executes code to steal credentials, install malware, or establish foothold for further attacks within the user's context.
If Mitigated
Attack fails due to patched software, application sandboxing, or user not opening malicious file.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code known at advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.005.30575 or 24.002.20737
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb24-29.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest version. 4. Restart computer if required.
🔧 Temporary Workarounds
Disable JavaScript in Adobe Reader
allPrevents JavaScript execution which may be used in exploitation chain
Edit > Preferences > JavaScript > Uncheck 'Enable Acrobat JavaScript'
Use Protected View
allOpen untrusted PDFs in Protected View mode
File > Open > Select 'Protected View' option
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only
- Implement application whitelisting to block Acrobat Reader execution
- Use alternative PDF viewers temporarily
🔍 How to Verify
Check if Vulnerable:
Check Adobe Acrobat Reader version against affected versions listCheck Version:
Help > About Adobe Acrobat Reader DCVerify Fix Applied:
Verify version is 20.005.30575 or higher for continuous track, or 24.002.20737 or higher for classic track📡 Detection & Monitoring
Log Indicators:
- Unexpected Acrobat Reader crashes
- Suspicious child processes spawned from Acrobat Reader
Network Indicators:
- Outbound connections from Acrobat Reader to unknown IPs
- DNS requests for suspicious domains after PDF opening
SIEM Query:
process_name:"AcroRd32.exe" OR process_name:"Acrobat.exe" AND (event_type:crash OR parent_process:unusual)