CVE-2020-24436: Adobe Acrobat Pro DC PDF Export Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exporting of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-24436?
CVE-2020-24436 is a vulnerability in Adobe Acrobat Pro DC that allows remote attackers to execute arbitrary code.
How does CVE-2020-24436 work?
CVE-2020-24436 exploits an out-of-bounds write vulnerability during the exporting of PDF files.
What is the severity of CVE-2020-24436?
CVE-2020-24436 has a severity rating of 7.8 (High).
Which versions of Adobe Acrobat Pro DC are affected by CVE-2020-24436?
Adobe Acrobat Pro DC versions up to and including 20.001.30005 are affected.
How can I fix CVE-2020-24436?
Make sure to update Adobe Acrobat Pro DC to version 20.001.30006 or later to fix CVE-2020-24436.