CVE-2024-39423

ZDI-CAN-24182: New Vulnerability Report - Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

Description

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Scores

Weaknesses (CWE)

• CWE-787

European references

• ENISA EUVD · EUVD-2024-37967
• GCVE · GCVE-0-2024-39423

CERT-FR advisories

• CERTFR-2024-AVI-0678 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30005 < 20.005.30655
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 24.001.20604 < 24.001.30159
• cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 < 24.002.21005
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.3005 < 20.005.30655
• cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 < 24.002.21005

Affected products

References

• https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

Sources