CVE-2024-34100

Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF file

Description

Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Scores

Weaknesses (CWE)

• CWE-416

European references

• ENISA EUVD · EUVD-2024-34629
• GCVE · GCVE-0-2024-34100

CERT-FR advisories

• CERTFR-2024-AVI-0406 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.007.20033 < 24.002.20759
• cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.007.20033 < 24.002.20759
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30002 < 20.005.30635
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.30002 < 20.005.30635
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30002 < 20.005.30636
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.30002 < 20.005.30636

Affected products

References

• https://helpx.adobe.com/security/products/acrobat/apsb24-29.html

Sources