CVE-2020-24426: Adobe Acrobat Reader DC ID Parameter Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the ID parameter in the PDF trailer. By performing actions in JavaScript, an attacker can disclose the base address of AcroForm.api. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-24426?
CVE-2020-24426 has been classified as a medium severity vulnerability due to its potential to disclose sensitive memory.
How do I fix CVE-2020-24426?
To mitigate CVE-2020-24426, users should update to the latest versions of Adobe Acrobat Reader DC or Acrobat DC provided by Adobe.
What types of software are affected by CVE-2020-24426?
CVE-2020-24426 affects Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and Adobe Acrobat DC versions 2017.011.30175 and earlier.
Can CVE-2020-24426 be exploited remotely?
Yes, an attacker could potentially leverage CVE-2020-24426 to remotely disclose sensitive information from a victim's system.
What is the nature of the vulnerability in CVE-2020-24426?
CVE-2020-24426 is an out-of-bounds read vulnerability that allows attackers to read sensitive memory locations.