CVE-2024-49535: Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
First published: Tue Dec 10 2024(Updated: )
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. This vulnerability allows an attacker to provide malicious XML input containing a reference to an external entity, leading to data disclosure or potentially code execution. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Adobe Acrobat Reader | >=20.001.30002<20.005.30748 | |
| Adobe Acrobat Reader | >=24.0.0<24.001.30225 | |
| Adobe Acrobat Dc | <24.005.20320 | |
| Adobe Acrobat Reader | >=20.001.30002<20.005.30748 | |
| Adobe Acrobat Reader DC | <24.005.20320 | |
| Any of | ||
| Apple macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.001.30002
- version/adobe acrobat reader/24.0.0
- canonical/adobe acrobat dc
- canonical/adobe acrobat reader dc
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows