Use-After-Free Vulnerability in Adobe Acrobat and Reader Products
CVE-2020-9715
Key Information:
- Vendor
Adobe
- Status
- Vendor
- CVE Published:
- 19 August 2020
Badges
What is CVE-2020-9715?
Adobe Acrobat and Reader are susceptible to a use-after-free vulnerability that may allow attackers to execute arbitrary code on compromised systems. This vulnerability affects several versions of the software, enabling potential exploitation through crafted files that leverage the memory management flaw. Users are advised to review their version and apply the recommended updates to mitigate risks.
CISA has reported CVE-2020-9715
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2020-9715 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
Adobe Acrobat and Reader 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier versions
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
33% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🦅
CISA Reported
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved