CVE-2020-24433: Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege…

PriorityP348high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

15.24%

96.4th percentile

Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	<= 20.001.30005	—
adobe	acrobat_dc	<= 17.011.30175	—
adobe	acrobat_dc	<= 20.012.20048	—
adobe	acrobat_reader	<= 20.001.30005	—
adobe	acrobat_reader	unspecified – 2017.011.30175	—
adobe	acrobat_reader_dc	<= 17.011.30175	—
adobe	acrobat_reader_dc	<= 20.012.20048	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.