CVE-2020-24432: Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents
First published: Thu Nov 05 2020(Updated: )
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175 (and earlier) are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the current user. To exploit this issue, an attacker must acquire and then modify a certified PDF document that is trusted by the victim. The attacker then needs to convince the victim to open the document.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | <=20.001.30005 | |
| Adobe Acrobat | <=17.011.30175 | |
| Adobe Acrobat | <=20.012.20048 | |
| Adobe Acrobat Reader | <=20.001.30005 | |
| Adobe Acrobat Reader | <=17.011.30175 | |
| Adobe Acrobat Reader | <=20.012.20048 | |
| Apple iOS and macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2020-24432?
CVE-2020-24432 is considered to have a critical severity rating due to the potential for arbitrary JavaScript execution.
How do I fix CVE-2020-24432?
To fix CVE-2020-24432, you should update your Adobe Acrobat Reader DC or Adobe Acrobat DC to the latest version provided by Adobe.
Which versions of Adobe Acrobat are affected by CVE-2020-24432?
CVE-2020-24432 affects Adobe Acrobat Reader DC versions up to 20.001.30005 and Adobe Acrobat DC versions up to 20.012.20048.
What impact does CVE-2020-24432 have on affected systems?
The impact of CVE-2020-24432 includes the risk of malicious JavaScript code executing, which can lead to further exploitation of the system.
How can I determine if my Adobe Acrobat software is vulnerable to CVE-2020-24432?
You can determine vulnerability to CVE-2020-24432 by checking if your software version is 20.001.30005 or earlier for Reader or 20.012.20048 or earlier for Acrobat DC.
- agent/type
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/title
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30005
- canonical/adobe acrobat
- version/adobe acrobat/17.011.30175
- version/adobe acrobat/20.012.20048
- version/adobe acrobat reader/17.011.30175
- version/adobe acrobat reader/20.012.20048
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows