CVE-2024-20726: Adobe Acrobat DC RCE Vulnerability

CVE-2024-20726 Overview

CVE-2024-20726 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat and Adobe Acrobat Reader on Windows and macOS. Adobe Acrobat DC and Acrobat Reader DC versions 20.005.30539, 23.008.20470 and earlier are impacted. An attacker who convinces a user to open a crafted PDF can trigger memory corruption and execute arbitrary code in the context of the current user. Exploitation requires user interaction. Adobe published a security advisory (APSB24-07) addressing this issue.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the user opening a malicious PDF, enabling foothold establishment on the endpoint.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) up to 20.005.30539 / 23.008.20470
Adobe Acrobat and Acrobat Reader (Classic track) up to the versions listed in APSB24-07
Microsoft Windows and Apple macOS installations of the affected products

Discovery Timeline

2024-02-15 - CVE-2024-20726 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20726

Vulnerability Analysis

The flaw is an out-of-bounds write in Adobe Acrobat and Acrobat Reader when parsing structured content inside a PDF document. The product writes data past the end of an allocated buffer, corrupting adjacent memory. An attacker who controls the size or content of the write primitive can overwrite pointers, function tables, or object metadata used by the renderer. This corruption path leads to arbitrary code execution inside the Acrobat process. The attack is local because the malicious file must be delivered to and opened by the victim, typically through email attachments, drive-by downloads, or shared cloud storage.

Root Cause

The root cause is missing or incorrect bounds validation in a PDF parsing routine within Acrobat and Acrobat Reader. When the affected code processes attacker-supplied data, it computes an offset or length without validating it against the destination buffer size. Adobe has not published the exact component involved. The weakness is classified under [CWE-787] Out-of-Bounds Write.

Attack Vector

Exploitation requires a user to open a malicious PDF with a vulnerable Acrobat or Reader build. Once opened, the crafted document triggers the vulnerable parser, corrupts memory, and hijacks control flow. Because execution runs as the current user, subsequent actions include credential theft, dropping additional payloads, and lateral movement. No verified proof-of-concept or in-the-wild exploitation has been published. Refer to the Adobe Acrobat Security Advisory APSB24-07 for vendor-authoritative details.

Detection Methods for CVE-2024-20726

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, or wscript.exe
Acrobat processes writing executable files or scripts into user-writable directories like %APPDATA% or %TEMP%
Outbound network connections initiated directly by the Acrobat process to previously unseen hosts
Crash telemetry showing access violations inside Acrobat or Reader modules while parsing PDF content

Detection Strategies

Hunt for process lineage where Acrobat or Reader is the parent of interpreter or LOLBin processes
Alert on Acrobat modules loading unusual DLLs from user-writable paths
Correlate PDF file opens with immediate registry autorun or scheduled task creation

Monitoring Recommendations

Inventory Acrobat and Reader versions across the fleet and flag installations at or below 20.005.30539 and 23.008.20470
Ingest endpoint process, file, and module-load telemetry into a central SIEM or data lake for retrospective hunting
Monitor mail and web gateways for PDF attachments from untrusted senders and detonate suspicious samples in a sandbox

How to Mitigate CVE-2024-20726

Immediate Actions Required

Update Adobe Acrobat DC, Acrobat Reader DC, Acrobat 2020, and Reader 2020 to the fixed versions listed in APSB24-07
Prioritize patching on endpoints where users routinely open externally sourced PDFs
Restrict administrative rights so exploitation runs in a lower-privilege context
Enable Acrobat Protected View and Protected Mode to sandbox PDF rendering

Patch Information

Adobe released fixed builds in the Adobe Acrobat Security Advisory APSB24-07. Administrators should deploy the patched Continuous and Classic track releases through Adobe Update Server, SCCM, Intune, or Jamf, then validate versions with HKLM\Software\Adobe\Adobe Acrobat on Windows or the Info.plist on macOS.

Workarounds

Block or quarantine PDF attachments from untrusted senders at the email gateway until patching is complete
Enforce Protected View for files originating from the internet and other unsafe locations via Acrobat Group Policy
Use application allowlisting to prevent Acrobat from launching command interpreters and script hosts

bash

# Windows Group Policy registry keys to enforce Acrobat Protected View and Protected Mode
reg add "HKLM\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cDefaultLaunchAttachmentPerms" /v iUnlistedAttachmentTypePerm /t REG_DWORD /d 3 /f