CVE-2024-30303: Adobe Acrobat RCE Vulnerability

CVE-2024-30303 Overview

CVE-2024-30303 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Adobe Acrobat Reader. The flaw impacts Acrobat Reader versions 20.005.30539, 23.008.20470, and earlier releases across the Classic and Continuous tracks. Successful exploitation results in arbitrary code execution in the context of the current user. The attack requires local access and user interaction, meaning a victim must open a malicious PDF file crafted by an attacker.

Critical Impact
Arbitrary code execution in the context of the current user through a malicious PDF, with a CVSS 3.1 score of 7.8 (HIGH).

Affected Products

Adobe Acrobat (Classic track) — versions 23.008.20470 and earlier
Adobe Acrobat DC and Acrobat Reader DC (Continuous track) — versions 20.005.30539 and earlier
Runs on Microsoft Windows and Apple macOS platforms

Discovery Timeline

2024-05-02 - CVE-2024-30303 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30303

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat and Acrobat Reader's PDF parsing logic. Use After Free flaws occur when a program continues to reference memory that has already been released back to the allocator. An attacker who controls the contents of the freed region can force the process to execute attacker-supplied data as code or control-flow pointers.

In this case, opening a specially crafted PDF triggers the dangling reference. Because the vulnerable operation runs inside the Acrobat process, code execution occurs with the privileges of the user who opened the document. This makes the flaw a strong candidate for phishing chains and initial-access payloads.

Root Cause

The root cause is improper object lifetime management inside Acrobat's document handling routines. A referenced object is freed while at least one pointer to it remains reachable in the parser or JavaScript engine state. Subsequent operations dereference the stale pointer, allowing attackers to influence what memory is read, written, or executed.

Attack Vector

Exploitation requires the victim to open a malicious PDF locally, either from an email attachment, download, or shared file. The attacker crafts PDF content that manipulates the allocator into placing controlled data at the freed object's address. The vulnerability does not require elevated privileges before exploitation but is bounded by the current user's rights. See the Adobe Acrobat Security Advisory APSB24-07 for vendor-published technical context.

Detection Methods for CVE-2024-30303

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, especially cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Acrobat processes writing executables, scripts, or DLLs into user-writable paths such as %APPDATA%, %TEMP%, or ~/Library/Caches.
Outbound network connections originating from Acrobat processes to previously unseen domains or IP addresses.

Detection Strategies

Monitor for anomalous process trees where a PDF reader spawns interpreters or shell utilities.
Alert on Acrobat processes loading unsigned or unusual modules, which can indicate post-exploitation DLL side-loading.
Inspect PDF files for suspicious JavaScript, embedded objects, or malformed structures using static analysis tooling before delivery.

Monitoring Recommendations

Collect endpoint telemetry that captures process ancestry, module loads, and file writes performed by Acrobat components.
Track EPSS scoring trends and re-evaluate exposure if in-the-wild exploitation activity is reported.
Correlate email gateway logs with endpoint activity to identify users who opened suspicious PDF attachments.

How to Mitigate CVE-2024-30303

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in Adobe security bulletin APSB24-07.
Prioritize patching endpoints used for handling external documents, including help desks, legal, and finance workstations.
Enforce least-privilege user accounts so that successful exploitation does not immediately grant administrative access.

Patch Information

Adobe addressed the vulnerability in the APSB24-07 update cycle. Users on the Continuous track should upgrade beyond 20.005.30539, and users on the Classic 2020 track should upgrade beyond 23.008.20470. Full version guidance is available in the Adobe Acrobat Security Advisory.

Workarounds

Enable Protected View and Protected Mode in Acrobat to sandbox rendering of untrusted PDF documents.
Disable JavaScript execution within Acrobat via preferences or enterprise policy for users who do not require it.
Block or quarantine PDF attachments from untrusted external senders at the email gateway until patches are deployed.

bash

# Windows registry example: disable JavaScript in Acrobat Reader DC via GPO/registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Verify installed Acrobat Reader version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer" /v VersionMax