CVE-2024-20747: TALOS-2023-1908 - Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerability
Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe Acrobat Readerto a version that resolves this vulnerability.Patch TALOS-2023-1908 - Upgrade
Upgrade
Adobe Acrobat Readerto a version that resolves this vulnerability.Fixed in 23.008.20470
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20747?
CVE-2024-20747 has a high severity rating due to its potential to disclose sensitive memory.
How do I fix CVE-2024-20747?
To fix CVE-2024-20747, update Adobe Acrobat Reader or Adobe Acrobat to the latest patched version.
Which versions of Adobe Acrobat are affected by CVE-2024-20747?
Adobe Acrobat versions 20.005.30539, 23.008.20470 and earlier are affected by CVE-2024-20747.
Can CVE-2024-20747 be exploited on macOS or Windows?
CVE-2024-20747 affects only vulnerable versions of Adobe Acrobat and Acrobat Reader, independent of the underlying operating system.
What are the potential impacts of exploiting CVE-2024-20747?
Exploitation of CVE-2024-20747 could lead to the disclosure of sensitive information and allow attackers to bypass security mitigations.