CVE-2024-20728: Adobe Acrobat DC RCE Vulnerability

CVE-2024-20728 Overview

CVE-2024-20728 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts versions 20.005.30539, 23.008.20470 and earlier on both Windows and macOS. Attackers can achieve arbitrary code execution in the context of the current user by delivering a crafted PDF file. Exploitation requires user interaction, meaning a victim must open the malicious file. Adobe addressed the issue in security advisory APSB24-07. The vulnerability carries an EPSS score of 2.791% (85th percentile), reflecting elevated exploitation likelihood relative to the broader CVE population.

Critical Impact
Successful exploitation allows arbitrary code execution with the privileges of the user running Acrobat or Reader, enabling malware installation, credential theft, and lateral movement from a single opened PDF.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 23.008.20470 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30539 and earlier
Deployments on Microsoft Windows and Apple macOS

Discovery Timeline

2024-02-15 - CVE-2024-20728 published to the National Vulnerability Database (NVD)
2024-02-13 - Adobe releases security advisory APSB24-07 addressing the vulnerability
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20728

Vulnerability Analysis

The issue is an out-of-bounds write in Adobe Acrobat and Reader triggered during PDF processing. When the application parses a malformed object, it writes data past the bounds of an allocated buffer. This corruption of adjacent memory can be steered by an attacker to overwrite control-flow structures such as function pointers or vtable entries. Because Acrobat handles a wide variety of embedded content including fonts, images, JavaScript, and XFA forms, attackers have multiple parsing paths to target. The attack vector is local, but the malicious PDF can be delivered through email, chat, or web downloads, making the practical delivery footprint broad.

Root Cause

The root cause is insufficient validation of size or index values used during PDF object handling. The parser accepts attacker-controlled length or offset fields without proper boundary checks, allowing writes beyond the intended buffer. Adobe classifies the defect under CWE-787: Out-of-bounds Write, consistent with a memory-safety flaw in native parsing code.

Attack Vector

An attacker crafts a malicious PDF that triggers the out-of-bounds write when opened. The victim must open the file in a vulnerable Acrobat or Reader version. Code execution occurs in the user's security context. Because no privileged access is required to launch the file, standard users are equally exposed. Refer to the Adobe Security Advisory APSB24-07 for vendor-confirmed technical scope.

No verified public proof-of-concept code is available for CVE-2024-20728. Technical exploitation details are not published by Adobe, and no CISA KEV entry exists for this identifier at the time of writing.

Detection Methods for CVE-2024-20728

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, particularly cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
PDF files opened from temporary directories, email attachments, or browser download folders immediately preceding suspicious process activity
Crash events or Windows Error Reporting entries referencing Acrobat modules following the opening of a specific PDF
Outbound network connections initiated by Acrobat processes to previously unseen domains or IP addresses

Detection Strategies

Deploy behavioral endpoint detection rules that flag Acrobat and Reader spawning shells, script interpreters, or LOLBins as anomalous.
Alert on Acrobat processes writing executable content (.exe, .dll, .js) to user-writable directories such as %TEMP% or %APPDATA%.
Correlate email gateway telemetry with endpoint PDF-open events to identify suspicious attachment-driven exploitation chains.

Monitoring Recommendations

Inventory installed Acrobat and Reader versions across the estate and flag hosts running builds at or below 23.008.20470 (Continuous) and 20.005.30539 (Classic).
Enable process command-line and parent-child logging on Windows and macOS endpoints to support post-incident reconstruction.
Monitor for repeated Acrobat crashes across multiple users, which can indicate exploitation attempts or unstable payloads.

How to Mitigate CVE-2024-20728

Immediate Actions Required

Apply the Adobe security updates released in APSB24-07 to all Acrobat and Reader installations.
Prioritize patching for users who routinely handle external PDFs such as legal, HR, finance, and executive assistants.
Restrict execution of unsigned macros, JavaScript, and embedded content within Acrobat via enterprise configuration policies.

Patch Information

Adobe published fixed builds in advisory APSB24-07 on February 13, 2024. Continuous track users should update to the release above 23.008.20470, and Classic track users should update to the release above 20.005.30539. Enterprise deployments using Adobe Admin Console or SCCM should push the update through managed distribution channels. Verify patch status through the Acrobat Help > About menu or by querying installed application versions with software inventory tooling.

Workarounds

Disable JavaScript in Acrobat and Reader through Edit > Preferences > JavaScript where business workflows permit.
Enable Protected View and Protected Mode to sandbox PDF parsing and limit the blast radius of successful exploitation.
Block or quarantine inbound PDF attachments at the email gateway when they originate from untrusted senders until patching is complete.

bash

# Windows: query installed Acrobat/Reader version via registry
reg query "HKLM\SOFTWARE\Adobe\Acrobat Reader" /s /f "DisplayName"

# Enforce Protected View for all files (Reader/Acrobat DC)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f

# Disable JavaScript in Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f