CVE-2020-9695: Adobe Acrobat Reader RCE Vulnerability

CVE-2020-9695 Overview

CVE-2020-9695 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction, and the attack vector is local. Adobe published the corresponding security advisory under bulletin APSB20-48.

Critical Impact
Successful exploitation results in arbitrary code execution in the security context of the current user, enabling installation of malware, data theft, or pivoting within the host environment.

Affected Products

Adobe Acrobat Reader 2020.009.20074 and earlier 2020.x releases
Adobe Acrobat Reader 2020.001.30002 and earlier classic 2020 track releases
Adobe Acrobat Reader 2017.011.30171 and 2015.006.30523 and earlier

Discovery Timeline

2026-06-23 - CVE-2020-9695 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2020-9695

Vulnerability Analysis

The vulnerability is an out-of-bounds write within Adobe Acrobat Reader's document parsing logic. Acrobat Reader processes PDF objects and embedded streams during file rendering. When the affected versions parse a malformed object, the code writes data past the bounds of an allocated buffer. This corruption of adjacent memory enables an attacker to manipulate control structures inside the process. With careful crafting of the malicious PDF, the write primitive becomes a code execution primitive that runs attacker-supplied instructions under the user's privileges.

The Adobe advisory categorizes the issue under [CWE-787] Out-of-Bounds Write and confirms arbitrary code execution as the impact. The EPSS probability is 0.174%, indicating a low observed exploitation likelihood in the wild.

Root Cause

The root cause is improper validation of size or index values prior to writing into a fixed-length buffer during PDF parsing. The parser trusts attacker-controlled fields from a crafted document and computes destination offsets without enforcing buffer bounds. This permits a write beyond the allocated region.

Attack Vector

Exploitation requires a victim to open a malicious PDF file on a vulnerable installation. Typical delivery occurs through phishing email attachments, drive-by download links, or shared documents on collaboration platforms. After the user opens the file, Acrobat Reader processes the embedded malicious object and triggers the out-of-bounds write, leading to code execution in the user's session.

No verified proof-of-concept code is publicly associated with CVE-2020-9695.
Refer to Adobe security bulletin APSB20-48 for vendor technical details.

Detection Methods for CVE-2020-9695

Indicators of Compromise

Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or scripting hosts.
Acrobat Reader processes initiating outbound network connections to untrusted hosts after opening a PDF.
New persistence artifacts (scheduled tasks, run keys, services) created within minutes of a PDF being opened.
Crash events or WER (Windows Error Reporting) entries referencing Acrobat Reader modules with access violation codes.

Detection Strategies

Monitor process lineage where Acrobat Reader is the parent of LOLBin or interpreter processes.
Inspect PDF attachments at the mail gateway for malformed object streams and JavaScript actions inconsistent with business document templates.
Hunt for unsigned binaries written to %APPDATA% or %TEMP% shortly after PDF open events.

Monitoring Recommendations

Enable command-line and process-creation logging (Windows Event ID 4688 with command-line auditing, or Sysmon Event ID 1) across endpoints with Acrobat Reader installed.
Forward endpoint telemetry to a centralized analytics platform to correlate Acrobat activity with subsequent network and file-system events.
Track Acrobat Reader version inventories to confirm patch coverage across the fleet.

How to Mitigate CVE-2020-9695

Immediate Actions Required

Upgrade Adobe Acrobat and Acrobat Reader to the fixed releases listed in the Adobe Acrobat Security Advisory APSB20-48.
Confirm automatic updates are enabled on user endpoints and verify the installed build matches the patched version.
Restrict opening of PDFs from untrusted sources through email filtering and user awareness.

Patch Information

Adobe addressed CVE-2020-9695 in the security update documented in APSB20-48. The advisory lists the specific patched build numbers for Acrobat DC, Acrobat 2020, Acrobat 2017, and Acrobat 2015 tracks. Apply the update corresponding to the deployed track. See the Adobe Acrobat Security Advisory for download links and release notes.

Workarounds

Enable Protected View and Protected Mode in Acrobat Reader to sandbox PDF rendering.
Disable JavaScript execution in Acrobat Reader preferences for environments that do not require it.
Configure attachment policies on mail gateways to quarantine PDFs originating from external or unverified senders.

bash

# Disable JavaScript in Adobe Acrobat Reader via registry (Windows)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f