CVE-2024-30279: Adobe Acrobat DC RCE Vulnerability

CVE-2024-30279 Overview

CVE-2024-30279 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat and Acrobat Reader. Adobe Acrobat Reader versions 20.005.30574, 24.002.20736, and earlier releases contain the flaw across the Continuous and Classic tracks on Windows and macOS. Successful exploitation results in arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file. Adobe published fixes in security bulletin APSB24-29.

Critical Impact
Attackers who trick a user into opening a crafted PDF can execute arbitrary code with the privileges of the current user, enabling malware installation, credential theft, and lateral movement.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) 20.005.30574 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) 24.002.20736 and earlier
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2024-05-23 - CVE-2024-30279 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30279

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within Adobe Acrobat and Acrobat Reader's PDF parsing logic. The affected code paths write data past the bounds of an allocated buffer while processing attacker-controlled content inside a malicious PDF. Writing beyond the buffer boundary corrupts adjacent memory structures such as heap metadata, object pointers, or function pointers used by the renderer. An attacker who controls the values written can pivot memory corruption into arbitrary code execution in the current user's context. Because Acrobat Reader is widely deployed on both Windows and macOS endpoints, the vulnerability provides a broad attack surface for phishing and drive-by download campaigns.

Root Cause

The root cause is inadequate bounds validation when parsing structures inside a PDF document. Acrobat allocates a buffer sized for expected input, but a malformed or oversized field in the PDF causes the parser to write beyond the allocation. Adobe's advisory APSB24-29 classifies the issue as an out-of-bounds write leading to arbitrary code execution. The precise object type and code path are not disclosed in the public advisory.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted PDF through email attachment, malicious link, or file share. When the victim opens the file in a vulnerable Acrobat or Acrobat Reader build, the parser processes the malicious content and triggers the out-of-bounds write. Code execution occurs with the privileges of the logged-in user. Reader sandbox mitigations (Protected Mode on Windows, Protected View) reduce but do not eliminate impact for chained exploits. Public exploit code is not currently listed in ExploitDB, and the vulnerability is not on the CISA KEV catalog. The EPSS score places this CVE in a high-probability tier for near-term exploitation activity.

No verified proof-of-concept is publicly available. See the Adobe Security Bulletin APSB24-29 for vendor technical context.

Detection Methods for CVE-2024-30279

Indicators of Compromise

Acrobat or Acrobat Reader process (Acrobat.exe, AcroRd32.exe, AdobeAcrobat) crashing or spawning child processes such as cmd.exe, powershell.exe, or bash shortly after opening a PDF.
Unexpected outbound network connections initiated by Acrobat processes to unfamiliar domains or IP addresses.
PDF files delivered by email or download that contain malformed objects, embedded JavaScript, or unusually large stream data.
New persistence artifacts (Run keys, LaunchAgents, scheduled tasks) created within seconds of a PDF being opened.

Detection Strategies

Alert on Acrobat processes creating child processes, writing executables, or loading unsigned DLLs from user-writable paths.
Inspect email gateways for PDF attachments and sandbox-detonate samples to identify parser crashes indicative of exploitation attempts.
Correlate endpoint telemetry with EDR rules for memory corruption behavior in Acrobat.exe and AcroRd32.exe.

Monitoring Recommendations

Monitor Acrobat and Reader version inventory across endpoints and flag hosts running builds older than 20.005.30574 (Continuous) or 24.002.20736 (Classic).
Enable and centrally collect Windows Defender Exploit Guard, macOS EndpointSecurity, or equivalent process-creation logs from Acrobat processes.
Track PDF file provenance (mark-of-the-web, source URL) to prioritize investigation of documents from untrusted origins.

How to Mitigate CVE-2024-30279

Immediate Actions Required

Update Adobe Acrobat DC and Acrobat Reader DC (Continuous) to the fixed release identified in APSB24-29, and update Classic-track builds beyond 24.002.20736.
Prioritize patching endpoints used by high-risk roles that routinely open external PDF attachments, such as finance, HR, legal, and executive assistants.
Block delivery of PDF files from untrusted external senders at the mail gateway until patching completes.

Patch Information

Adobe released fixes in security bulletin Adobe Security Patch APSB24-29. Apply the updated Continuous or Classic build appropriate to your deployment channel on both Windows and macOS.

Workarounds

Enable Protected Mode and Protected View in Acrobat and Reader to sandbox PDF rendering on Windows.
Disable JavaScript in Acrobat and Reader via Preferences to reduce the exploitation surface for PDF-based attacks.
Configure Group Policy or MDM to restrict Acrobat from launching child processes and from loading external content in PDFs.

bash

# Windows: disable Acrobat JavaScript via registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Windows: enforce Protected View for files from the internet
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f