CVE-2020-9711 Overview
CVE-2020-9711 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Adobe Acrobat and Reader. The flaw allows an attacker to disclose sensitive memory contents from the process address space. Exploitation requires user interaction, where a victim must open a malicious file crafted by the attacker. Successful exploitation can leak data such as memory pointers and other sensitive in-process information that may aid further attacks, including bypasses of address space layout randomization (ASLR).
Critical Impact
An attacker who convinces a user to open a malicious document can read memory outside intended bounds and exfiltrate sensitive information from the Acrobat Reader process.
Affected Products
- Adobe Acrobat and Reader 2020.009.20074 and earlier (2020 track)
- Adobe Acrobat and Reader 2020.001.30002 and earlier (Classic 2020)
- Adobe Acrobat and Reader 2017.011.30171 and earlier (Classic 2017), and 2015.006.30523 and earlier (Classic 2015)
Discovery Timeline
- 2026-06-23 - CVE-2020-9711 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2020-9711
Vulnerability Analysis
The vulnerability is an out-of-bounds read condition within Adobe Acrobat and Reader file parsing routines. When the application processes a malformed document, it reads data past the end of an allocated buffer. The resulting memory contents are returned to attacker-influenced code paths, enabling disclosure of process memory. The issue impacts confidentiality only and does not directly enable code execution or modification of data. Exploitation is local in scope because the attacker must deliver a malicious file and the victim must open it in a vulnerable Acrobat or Reader installation.
Root Cause
The root cause is missing or insufficient bounds validation during parsing of attacker-controlled structures inside a PDF file. A length, offset, or index field is trusted without verifying it against the actual buffer size, so the parser dereferences memory beyond the allocation. This pattern is consistent with CWE-125 (Out-of-bounds Read) and typically results from arithmetic on user-supplied sizes prior to a memcpy-style read.
Attack Vector
The attack vector is a malicious PDF or related file delivered through email, web download, or shared storage. The user must open the file in a vulnerable version of Acrobat or Reader. Once opened, parsing of the crafted object triggers the out-of-bounds read, and the leaked bytes are returned to attacker-controlled JavaScript or scripting logic embedded in the document. The disclosed memory can be used to defeat ASLR and chain into other vulnerabilities for code execution.
No verified public exploit code is available for this issue. See the Adobe Acrobat Security Advisory for vendor technical details.
Detection Methods for CVE-2020-9711
Indicators of Compromise
- Unexpected Acrobat or Reader process crashes or hangs immediately after opening a PDF received from email or web sources.
- PDF files containing unusually large or malformed stream length fields, embedded JavaScript that probes object sizes, or anomalous object reference structures.
- Outbound network connections initiated by AcroRd32.exe or Acrobat.exe shortly after document open, suggesting exfiltration of leaked data.
Detection Strategies
- Inspect inbound PDF attachments at the email gateway and web proxy using sandbox detonation to flag documents that trigger memory access violations in Acrobat.
- Hunt for child process creation, scripting host invocation, or unusual file writes spawned by Acrobat or Reader processes.
- Correlate endpoint telemetry that shows Acrobat reading from unexpected memory regions or generating exception events with subsequent network egress.
Monitoring Recommendations
- Track Acrobat and Reader versions across the fleet and alert on hosts running builds at or below the affected versions listed in APSB20-48.
- Log document open events and PDF source URLs to support retrospective hunting if a campaign targeting this CVE is reported.
- Monitor for repeated Acrobat crashes from the same user, which can indicate iterative exploitation attempts.
How to Mitigate CVE-2020-9711
Immediate Actions Required
- Update Adobe Acrobat and Reader to the fixed versions listed in the Adobe security bulletin APSB20-48 on all endpoints.
- Block delivery of PDF attachments from untrusted external senders at the email gateway until patching is verified.
- Enable Protected View and Protected Mode in Acrobat and Reader to constrain parsing of untrusted documents.
Patch Information
Adobe released fixed builds for the affected tracks in security bulletin APSB20-48. Administrators should deploy the corresponding update for each installed track (2020 Continuous, Classic 2020, Classic 2017, and Classic 2015) and confirm the version after rollout.
Workarounds
- Disable JavaScript in Acrobat and Reader through the Preferences pane or via enterprise policy to reduce scriptable parsing paths.
- Restrict the ability to open PDF files from internet zones by enforcing the Protected View setting for files from untrusted locations.
- Route PDF rendering through a hardened viewer or browser-based renderer until endpoints are fully patched.
# Example: enforce Protected View and disable JavaScript via Windows registry
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
