CVE-2025-64899
published 2025-12-09CVE-2025-64899: Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.43%
35.2th percentile
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | >= 20.001.3005 < 20.005.30838 | 20.005.30838 |
| adobe | acrobat | >= 24.001.20604 < 24.001.30307 | 24.001.30307 |
| adobe | acrobat | >= 24.001.20604 < 24.001.30308 | 24.001.30308 |
| adobe | acrobat_dc | < 25.001.20997 | 25.001.20997 |
| adobe | acrobat_reader | <= 20.005.30803 | — |
| adobe | acrobat_reader | >= 20.001.3005 < 20.005.30838 | 20.005.30838 |
| adobe | acrobat_reader_dc | < 25.001.20997 | 25.001.20997 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-27278 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2026-27278 [LOW] CVE-2026-27278 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27278 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source : NVD
## 7.8
Score
Published March 10, 2026
Severity HIGH
CNA Score 7.8
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:adobe:acro
Wiz
CVE-2025-64899 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2025-64899 [LOW] CVE-2025-64899 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-64899 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source : NVD
## 7.8
Score
Published December 9, 2025
Severity HIGH
CNA Score 7.8
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA K
Wiz
CVE-2025-64787 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2025-64787 [LOW] CVE-2025-64787 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-64787 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass cryptographic protections and gain limited unauthorized write access. Exploitation of this issue does not require user interaction.
Source : NVD
## 4
Score
Published December 9, 2025
Severity MEDIUM
CNA Score 3.3
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Proba
Wiz
CVE-2026-27221 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2026-27221 [LOW] CVE-2026-27221 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27221 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to spoof the identity of a signer. Exploitation of this issue requires user interaction.
Source : NVD
## 5.5
Score
Published March 10, 2026
Severity MEDIUM
CNA Score 5.5
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
Wiz
CVE-2026-27220 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2026-27220 [LOW] CVE-2026-27220 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27220 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Source : NVD
## 7.8
Score
Published March 10, 2026
Severity HIGH
CNA Score 7.8
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:adobe:acro
Wiz
CVE-2025-64786 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.3
CVE-2025-64786 [LOW] CVE-2025-64786 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-64786 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited unauthorized write access. Exploitation of this issue does not require user interaction.
Source : NVD
## 4
Score
Published December 9, 2025
Severity MEDIUM
CNA Score 3.3
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploit
Wiz
CVE-2025-64785 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2025-64785 [HIGH] CVE-2025-64785 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-64785 :
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.
Source : NVD
## 8.4
Score
Published December 9, 2025
Severity HIGH
CNA Score 7.8
Affected Technologies
Adobe Acrobat Reader Continuous
Adobe Acrobat Classic
Has Public Exploi
2025-12-09
Published