CVE-2024-30301: Adobe Acrobat RCE Vulnerability

CVE-2024-30301 Overview

CVE-2024-30301 is a Use After Free vulnerability [CWE-416] in Adobe Acrobat and Acrobat Reader. Adobe Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected on both Windows and macOS. Successful exploitation results in arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a crafted PDF file. Adobe published the fix in security bulletin APSB24-07 on May 2, 2024. The flaw carries a CVSS 3.1 base score of 7.8 and an EPSS probability of 0.562% (percentile 43.7 as of August 11, 2026).

Critical Impact
Attackers who convince a user to open a malicious PDF can achieve arbitrary code execution with the privileges of the current user, enabling malware installation, credential theft, and lateral movement.

Affected Products

Adobe Acrobat DC (Continuous track) and Acrobat (Classic track) up to and including 23.008.20470 / 20.005.30539
Adobe Acrobat Reader DC (Continuous track) and Acrobat Reader (Classic track) up to and including 23.008.20470 / 20.005.30539
Windows and Apple macOS installations of the affected Acrobat and Reader products

Discovery Timeline

2024-05-02 - CVE-2024-30301 published to NVD and disclosed in Adobe advisory APSB24-07
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30301

Vulnerability Analysis

The issue is a Use After Free condition in Adobe Acrobat and Acrobat Reader parsing logic. Use After Free bugs occur when a program continues to reference memory that has already been released back to the allocator. The freed allocation can be replaced with attacker-controlled data through carefully staged object allocations. When the dangling pointer is dereferenced, the program operates on data the attacker chose. In Acrobat, PDF content such as embedded scripts, form fields, annotations, and streams gives adversaries fine-grained control over allocation patterns. This makes Use After Free primitives inside the Reader particularly reliable for building code execution exploits.

Root Cause

The underlying defect is a lifetime management error in a Reader object. Code releases an object while another code path retains a pointer to it. Subsequent access to that pointer reads or writes freed memory. Attackers can control the freed region by triggering allocations of the same size class, typically by injecting JavaScript inside the PDF or shaping specific object graphs.

Attack Vector

The attack vector is local and requires user interaction, consistent with the CVSS vector AV:L/UI:R. An attacker delivers a malicious PDF through email attachments, drive-by download, chat platforms, or shared file storage. When the victim opens the file in a vulnerable Acrobat or Reader build, the crafted objects trigger the freed-memory reuse. The exploit then pivots the corrupted pointer into a control-flow hijack, executing shellcode in the user's session. No elevated privileges are required for the attacker to stage the file, and the resulting code runs with the victim's rights.

No public proof-of-concept is listed for this CVE, and it is not tracked on the CISA Known Exploited Vulnerabilities catalog. See the Adobe Acrobat Security Advisory APSB24-07 for vendor technical details.

Detection Methods for CVE-2024-30301

Indicators of Compromise

Acrobat or Reader processes (AcroRd32.exe, Acrobat.exe) spawning shells or scripting hosts such as cmd.exe, powershell.exe, wscript.exe, or bash
Unexpected child processes writing executables into %TEMP%, %APPDATA%, or user profile directories immediately after a PDF is opened
Outbound network connections initiated by Acrobat processes to previously unseen or low-reputation domains
Crash artifacts or Windows Error Reporting entries referencing Acrobat modules with access violations on freed heap addresses

Detection Strategies

Deploy YARA rules targeting suspicious PDF constructs: embedded JavaScript combined with heavy object allocation patterns, malformed streams, or unusual /AcroForm structures
Hunt on endpoint telemetry for parent-child relationships where Acrobat or Reader spawns interpreters, LOLBins, or unsigned binaries
Correlate email gateway logs with endpoint PDF-open events to identify inbound campaigns delivering weaponized documents
Track installed Acrobat and Reader versions across the fleet to identify hosts still at or below 23.008.20470 and 20.005.30539

Monitoring Recommendations

Enable command-line and process-creation auditing on all Windows and macOS endpoints running Acrobat products
Forward Acrobat crash telemetry and Protected Mode broker logs to a central SIEM for analyst review
Monitor for module loads of scripting engines or shellcode staging DLLs inside Acrobat processes

How to Mitigate CVE-2024-30301

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the versions listed in Adobe advisory APSB24-07 on every Windows and macOS host
Inventory endpoints running Acrobat or Reader at or below 23.008.20470 (Continuous) and 20.005.30539 (Classic) and prioritize them for patching
Restrict opening of PDF attachments from external senders through email gateway policy and user awareness communications
Verify that Protected Mode and Protected View are enabled in Acrobat and Reader preferences

Patch Information

Adobe released fixed builds documented in the Adobe Acrobat Security Advisory APSB24-07. Administrators should deploy the updated Continuous track and Classic track builds through Adobe Update Server, Microsoft Endpoint Configuration Manager, Intune, Jamf, or the enterprise patching tool of choice. Confirm the installed build reports a version higher than 23.008.20470 or 20.005.30539 after deployment.

Workarounds

Enable Protected View for files from the Internet and potentially unsafe locations under Acrobat Preferences → Security (Enhanced)
Disable JavaScript in Acrobat and Reader through the Preferences → JavaScript panel to reduce heap-shaping primitives available to attackers
Configure application allowlisting or attack surface reduction rules to block Acrobat processes from spawning script interpreters and shells
Route PDF attachments through a sandboxed detonation service before delivery to end users

bash

# Windows registry example: disable JavaScript in Acrobat Reader DC as an interim workaround
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Verify installed Reader version on Windows
wmic datafile where name="C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe" get Version