CVE-2024-20729: Adobe Acrobat DC RCE Vulnerability

CVE-2024-20729 Overview

CVE-2024-20729 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier. The flaw allows an attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker. The vulnerability affects both Windows and macOS installations of Adobe Acrobat DC, Acrobat Reader DC, Acrobat, and Acrobat Reader across the continuous and classic tracks. Adobe published a security advisory (APSB24-07) addressing this issue in February 2024.

Critical Impact
Successful exploitation grants arbitrary code execution under the current user's privileges, enabling malware installation, data theft, or lateral movement from a single opened PDF.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 20.005.30539 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 23.008.20470 and earlier
Windows and macOS installations of the affected Adobe products

Discovery Timeline

2024-02-15 - CVE-2024-20729 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20729

Vulnerability Analysis

CVE-2024-20729 is classified as a Use After Free vulnerability [CWE-416] in Adobe Acrobat and Reader. Use After Free flaws occur when an application continues to reference memory after it has been freed. An attacker who controls the freed memory region can influence program flow when the dangling pointer is later dereferenced.

In Acrobat and Reader, parsing untrusted PDF structures can trigger object lifetime mismanagement during document rendering, JavaScript execution, or embedded content handling. When the freed object is reused, attacker-supplied data can be interpreted as a valid object or function pointer, redirecting execution to attacker-controlled code.

The issue carries an EPSS probability of approximately 3.39%, placing it in the 87th percentile for likelihood of exploitation activity.

Root Cause

The root cause is improper memory management in Acrobat's document processing code. A pointer to a freed object is retained and later dereferenced, producing undefined behavior. The condition can be reached through crafted PDF content that manipulates object lifetimes during parsing or rendering. See the Talos Intelligence Vulnerability Report for additional technical context.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious PDF and delivers it via email, drive-by download, messaging platforms, or shared drives. When the victim opens the file in a vulnerable version of Acrobat or Reader, the Use After Free condition triggers, executing attacker-supplied code with the privileges of the current user.

No public proof-of-concept exploit is listed in Exploit-DB, and the flaw is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are available in the Adobe Security Bulletin APSB24-07.

Detection Methods for CVE-2024-20729

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, particularly cmd.exe, powershell.exe, or scripting hosts
Acrobat or Reader processes writing executable files to user-writable directories such as %APPDATA%, %TEMP%, or ~/Library/Caches
Outbound network connections initiated by Acrobat processes to unknown or newly registered domains
PDF files delivered from untrusted email senders or containing obfuscated JavaScript streams

Detection Strategies

Monitor endpoint telemetry for anomalous process ancestry where Acrobat products spawn shells, script interpreters, or LOLBins
Deploy behavioral detection for memory corruption exploitation patterns such as ROP chains or shellcode execution within Acrobat process memory
Inspect PDF attachments at the email gateway for malformed object structures and suspicious embedded JavaScript

Monitoring Recommendations

Baseline expected Acrobat process behavior and alert on deviations including unusual file writes, registry modifications, or network activity
Correlate PDF opens with subsequent process creation and network events across the environment
Track Acrobat and Reader version inventory to identify hosts still running vulnerable builds

How to Mitigate CVE-2024-20729

Immediate Actions Required

Update Adobe Acrobat DC and Reader DC (Continuous) to a version later than 20.005.30539
Update Adobe Acrobat and Reader (Classic) to a version later than 23.008.20470
Audit endpoint inventory to identify unpatched installations on both Windows and macOS
Block or quarantine PDF attachments from untrusted external senders until patching is complete

Patch Information

Adobe released fixed versions in security bulletin APSB24-07. Administrators should deploy the updated builds referenced in the Adobe Acrobat Security Update advisory across all affected endpoints. Enable Acrobat's automatic update mechanism to reduce time-to-patch for future advisories.

Workarounds

Enable Acrobat Protected View for files originating from the internet and untrusted locations
Disable JavaScript execution within Acrobat and Reader through preferences or enterprise policy
Restrict opening PDF files sourced from external email or unknown web origins using application control policies
Configure attachment filtering at email gateways to sandbox or detonate PDF files before delivery

bash

# Windows: disable Acrobat JavaScript via registry (enterprise policy)
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Windows: enforce Protected View for all files
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f