Adobe Acrobat and Acrobat Reader Use After Free Vulnerability Allowing Arbitrary Code Execution

A use after free vulnerability has been identified in Adobe Acrobat and Acrobat Reader. This issue affects versions through 25.001.21265 of Acrobat DC and Acrobat Reader DC, as well as Acrobat 2024 versions through 24.001.30307 on Windows and versions through 24.001.30308 on macOS. The vulnerability could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, allowing an attacker to execute malicious code in the context of the user.

Remediation

Users are advised to update to the latest versions of Adobe Acrobat or Acrobat Reader. The latest versions can be downloaded manually or via the Adobe Update mechanism. For IT administrators, updates can be deployed using preferred methodologies such as AIP-GPO, SCUP/SCCM on Windows, or Apple Remote Desktop and SSH on macOS.