CVE-2020-24429highCWE-347

CVE-2020-24429: high-severity vulnerability in Adobe Acrobat Reader

Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation

Published · Updated

Follow this CVE+ Monitor Acrobat Reader

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 3.0%
In short

Acrobat Reader DC on macOS has a flaw where it doesn't properly verify digital signatures in PDF files, allowing an attacker to trick the application into trusting a malicious document. This could let an attacker gain higher privileges on the system if a user opens a specially crafted PDF.

Technical detail

A signature verification bypass in Acrobat Reader DC (macOS versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, 2017.011.30175 and earlier) allows local privilege escalation when a user opens a malicious PDF file. The vulnerability stems from improper validation of digital signatures, enabling an attacker to execute code with elevated privileges.

Summary generated and translated by AI from the official description.
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Adobe · Acrobat Reader
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2021-21017HIGHAcrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 86.3%KEVCVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 59.4%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 52.1%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 7.5%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%