CVE-2020-24436: Adobe Acrobat Pro DC PDF Export Out-Of-Bounds Write Remote Code Execution Vulnerability
First published: Tue Nov 03 2020(Updated: )
Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Pro DC | ||
| Adobe Acrobat Reader | <=20.001.30005 | |
| Adobe Acrobat Dc | <=17.011.30175 | |
| Adobe Acrobat Dc | <=20.012.20048 | |
| Adobe Acrobat Reader | <=20.001.30005 | |
| Adobe Acrobat Reader DC | <=17.011.30175 | |
| Adobe Acrobat Reader DC | <=20.012.20048 | |
| Apple macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-24436?
CVE-2020-24436 is a vulnerability in Adobe Acrobat Pro DC that allows remote attackers to execute arbitrary code.
How does CVE-2020-24436 work?
CVE-2020-24436 exploits an out-of-bounds write vulnerability during the exporting of PDF files.
What is the severity of CVE-2020-24436?
CVE-2020-24436 has a severity rating of 7.8 (High).
Which versions of Adobe Acrobat Pro DC are affected by CVE-2020-24436?
Adobe Acrobat Pro DC versions up to and including 20.001.30005 are affected.
How can I fix CVE-2020-24436?
Make sure to update Adobe Acrobat Pro DC to version 20.001.30006 or later to fix CVE-2020-24436.
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/title
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-1355
- alias/ZDI-CAN-11957
- alias/CVE-2020-24436
- agent/software-canonical-lookup
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30005
- canonical/adobe acrobat dc
- version/adobe acrobat dc/17.011.30175
- version/adobe acrobat dc/20.012.20048
- canonical/adobe acrobat reader dc
- version/adobe acrobat reader dc/17.011.30175
- version/adobe acrobat reader dc/20.012.20048
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe acrobat pro dc