CVE-2020-24431: Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security…

PriorityP419medium4.4CVSS 3.1

AVLACLPRNUIRSUCLILAN

EPSS

1.59%

73.1th percentile

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	<= 20.001.30005	—
adobe	acrobat_dc	<= 17.011.30175	—
adobe	acrobat_dc	<= 20.012.20048	—
adobe	acrobat_reader	<= 20.001.30005	—
adobe	acrobat_reader	unspecified – 2017.011.30175	—
adobe	acrobat_reader_dc	<= 17.011.30175	—
adobe	acrobat_reader_dc	<= 20.012.20048	—

CVSS provenance

nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.