CVE-2020-9713: Adobe Acrobat Reader Info Disclosure Flaw

CVE-2020-9713 Overview

CVE-2020-9713 is an out-of-bounds read vulnerability affecting Adobe Acrobat and Reader. The flaw allows disclosure of sensitive memory contents when a victim opens a crafted file. Exploitation requires user interaction, and the attack vector is local. The vulnerability is categorized under [CWE-125] (Out-of-bounds Read) and impacts confidentiality only, with no effect on integrity or availability.

Critical Impact
Attackers can read memory beyond intended buffer boundaries, exposing sensitive process memory that may include pointers, tokens, or document contents useful for follow-on exploitation.

Affected Products

Adobe Acrobat and Reader 2020.009.20074 and earlier
Adobe Acrobat and Reader 2020.001.30002, 2017.011.30171 and earlier
Adobe Acrobat and Reader 2015.006.30523 and earlier

Discovery Timeline

2026-06-23 - CVE-2020-9713 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2020-9713

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition in Adobe Acrobat and Reader file parsing logic. When the application processes a malformed PDF, it reads memory beyond the bounds of an allocated buffer. The disclosed bytes can leak sensitive process memory back to attacker-controlled content streams or be used to bypass mitigations such as Address Space Layout Randomization (ASLR).

Exploitation requires local user interaction. A victim must open a malicious PDF file delivered through phishing, drive-by download, or another social engineering channel. Successful exploitation does not directly grant code execution, but disclosed memory can chain into other Acrobat vulnerabilities targeting integrity or availability.

The EPSS score is 0.185%, indicating low observed exploitation likelihood, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or incorrect bounds checking during parsing of structured PDF objects. The parser dereferences an index or offset that exceeds the bounds of the source buffer, returning adjacent heap or stack memory to the calling routine. Adobe has not published the specific component responsible in public advisories.

Attack Vector

The attack vector is local with user interaction required. An attacker crafts a PDF document that triggers the out-of-bounds read during parsing. The victim opens the file in a vulnerable version of Acrobat or Reader. The application reads memory beyond the intended buffer and may expose its contents through embedded JavaScript, form fields, or rendered output.

No verified public proof-of-concept code is available. Refer to the Adobe Acrobat Security Patch advisory APSB20-48 for vendor technical details.

Detection Methods for CVE-2020-9713

Indicators of Compromise

PDF files with malformed object streams or unusual cross-reference tables that fail standard validation
Acrobat or Reader process crashes or anomalous memory access patterns following document open events
Outbound network connections from AcroRd32.exe or Acrobat.exe shortly after a document is opened

Detection Strategies

Inspect PDF attachments at the mail gateway for malformed structures and embedded JavaScript that probes memory contents
Monitor endpoint telemetry for child process creation, scripting engine invocation, or unexpected memory reads originating from Adobe processes
Correlate document open events with subsequent suspicious behavior such as credential access or lateral movement attempts

Monitoring Recommendations

Log Adobe Reader and Acrobat versions across the fleet and alert on hosts running unpatched releases listed in Adobe advisory APSB20-48
Capture PDF reader process telemetry including file opens, module loads, and network egress for retrospective hunting
Enable Protected View and Protected Mode logging to flag documents that attempt sandbox-restricted operations

How to Mitigate CVE-2020-9713

Immediate Actions Required

Update Adobe Acrobat and Reader to the fixed versions published in Adobe security bulletin APSB20-48
Inventory endpoints to confirm no installations remain on 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523, or earlier
Block delivery of untrusted PDF documents from external senders at the email gateway pending patch deployment

Patch Information

Adobe addressed CVE-2020-9713 in the security update referenced in Adobe Security Bulletin APSB20-48. Administrators should deploy the latest available Acrobat and Reader builds through the Adobe Admin Console, SCCM, Intune, or equivalent enterprise software management tooling.

Workarounds

Enable Protected View for all files originating from untrusted locations in Acrobat and Reader preferences
Disable JavaScript execution in Acrobat and Reader to limit the surface available to attacker-controlled content
Restrict opening of PDF files from email and web downloads using application control or attachment filtering policies

bash

# Configuration example: disable JavaScript in Adobe Reader via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files from untrusted sources
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f