CVE-2024-20730: Adobe Acrobat DC RCE Vulnerability

CVE-2024-20730 Overview

CVE-2024-20730 is an integer overflow vulnerability in Adobe Acrobat and Acrobat Reader that can lead to arbitrary code execution in the context of the current user. Adobe Acrobat DC and Acrobat Reader DC versions 20.005.30539, 23.008.20470, and earlier are affected across both Windows and macOS. Exploitation requires user interaction: a victim must open a crafted PDF file. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and carries a CVSS 3.1 base score of 7.8.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user opening the malicious PDF, enabling malware installation, credential theft, and lateral movement.

Affected Products

Adobe Acrobat DC (Continuous track), versions 23.008.20470 and earlier
Adobe Acrobat Reader DC (Continuous track), versions 23.008.20470 and earlier
Adobe Acrobat and Acrobat Reader (Classic track), versions 20.005.30539 and earlier on Windows and macOS

Discovery Timeline

2024-02-15 - CVE-2024-20730 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20730

Vulnerability Analysis

The flaw is an integer overflow or wraparound condition within Adobe Acrobat and Reader's PDF processing logic. When the application computes a size, offset, or count from attacker-controlled fields inside a malformed PDF, the arithmetic wraps past the maximum representable value and produces a small or negative result. Subsequent memory allocation and copy operations then rely on that incorrect value, leading to a corrupted heap state. Attackers weaponize this corruption to hijack control flow and execute arbitrary code in the user's security context.

The attack vector is local because the malicious file must be delivered to the endpoint and opened, but real-world delivery commonly occurs through phishing email attachments, drive-by downloads, and shared document workflows. According to EPSS data from 2026-08-18, this vulnerability sits in a high percentile relative to other CVEs, indicating elevated exploitation likelihood.

Root Cause

The root cause is missing or insufficient validation of size-related values parsed from PDF structures before those values are used in arithmetic operations tied to buffer allocation. The wrapped value bypasses length checks that assume unsigned arithmetic behaves monotonically. Detailed technical analysis is available in the Talos Vulnerability Report TALOS-2023-1906.

Attack Vector

An attacker crafts a PDF containing malformed objects that trigger the overflow during parsing or rendering. The attacker delivers the file to a victim through email, messaging, or a web download. When the victim opens the file in a vulnerable Acrobat or Reader build, the overflow occurs and shellcode executes under the victim's account. No prior authentication to the target system is required, but user interaction is mandatory.

Detection Methods for CVE-2024-20730

Indicators of Compromise

PDF files with anomalously large or negative length fields in stream dictionaries or object headers
Unexpected child processes spawning from AcroRd32.exe or Acrobat.exe, especially command interpreters or scripting hosts
Outbound network connections initiated by Acrobat or Reader processes shortly after a PDF is opened
New persistence artifacts (scheduled tasks, Run keys, LaunchAgents) created during or immediately after PDF viewing

Detection Strategies

Alert on process lineage where Acrobat.exe or AcroRd32.exe is the parent of cmd.exe, powershell.exe, wscript.exe, or bash
Inspect PDF attachments at the email gateway for malformed object streams and JavaScript actions consistent with exploitation frameworks
Correlate Acrobat crash events in Windows Application logs with subsequent suspicious process or network activity

Monitoring Recommendations

Track installed Acrobat and Reader versions across the fleet and flag hosts running builds at or below 23.008.20470 and 20.005.30539
Monitor file writes by Acrobat processes to user-writable execution paths such as %APPDATA%, %TEMP%, and ~/Library
Capture and retain endpoint telemetry for PDF-initiated activity to support retroactive threat hunting

How to Mitigate CVE-2024-20730

Immediate Actions Required

Apply the updates listed in Adobe Security Bulletin APSB24-07 to all Acrobat and Reader installations on Windows and macOS
Prioritize patching for users who routinely handle external PDFs, including finance, legal, HR, and executive assistants
Block inbound PDFs from untrusted senders at the mail gateway until endpoints are patched

Patch Information

Adobe released fixed builds in APSB24-07 on February 13, 2024. Administrators should upgrade Continuous track installations beyond 23.008.20470 and Classic track installations beyond 20.005.30539. Enterprise deployments can use Adobe's Admin Console, SCCM, Intune, or Jamf to push the updated installers.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Reader to sandbox PDF rendering
Disable JavaScript execution in Acrobat and Reader through the Preferences UI or enterprise policy for users who do not require it
Use an alternative, patched PDF reader for untrusted documents until Adobe updates are deployed

bash

# Windows: query installed Acrobat/Reader version via registry
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Adobe Acrobat" /s /v DisplayName
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader" /s /v DisplayName

# Disable JavaScript in Acrobat/Reader via HKLM policy
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f