CVE-2020-24438: Adobe Acrobat Reader DC AVDocumentLocal Use-After-Free Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AVDocumentLocal object. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-24438?
CVE-2020-24438 is classified as a high severity vulnerability due to its potential for memory address leaks.
How do I fix CVE-2020-24438?
To resolve CVE-2020-24438, update Adobe Acrobat Reader DC and Acrobat DC to the latest version provided by Adobe.
What versions are affected by CVE-2020-24438?
CVE-2020-24438 affects Acrobat Reader DC versions up to 20.001.30005 and Acrobat DC versions up to 20.012.20048 and 17.011.30175.
What type of vulnerability is CVE-2020-24438?
CVE-2020-24438 is a use-after-free vulnerability that can lead to memory address leaks.
Is user interaction required to exploit CVE-2020-24438?
Yes, exploiting CVE-2020-24438 requires user interaction to trigger the vulnerability.