CVE-2020-24430: Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free…

PriorityP351high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

17.93%

96.9th percentile

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	<= 20.001.30005	—
adobe	acrobat_dc	<= 17.011.30175	—
adobe	acrobat_dc	<= 20.012.20048	—
adobe	acrobat_reader	<= 20.001.30005	—
adobe	acrobat_reader	unspecified – 2017.011.30175	—
adobe	acrobat_reader_dc	<= 17.011.30175	—
adobe	acrobat_reader_dc	<= 20.012.20048	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.