CVE-2024-30304: Adobe Acrobat RCE Vulnerability

CVE-2024-30304 Overview

CVE-2024-30304 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted PDF file. Adobe published the vulnerability as part of security advisory APSB24-07.

The vulnerability affects both Windows and macOS installations of Acrobat and Acrobat Reader across the Continuous and Classic tracks. Successful exploitation requires user interaction, specifically opening a malicious document.

Critical Impact
Attackers can achieve arbitrary code execution with the privileges of the logged-in user by delivering a malicious PDF, enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Acrobat DC (Continuous) versions 23.008.20470 and earlier
Adobe Acrobat Reader DC (Continuous) versions 23.008.20470 and earlier
Adobe Acrobat and Acrobat Reader (Classic) versions 20.005.30539 and earlier on Microsoft Windows and Apple macOS

Discovery Timeline

2024-05-02 - CVE-2024-30304 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30304

Vulnerability Analysis

CVE-2024-30304 is a Use After Free condition in Adobe Acrobat and Acrobat Reader. The flaw arises when the application continues to reference memory that has already been freed during PDF parsing or object handling. An attacker who controls the freed allocation can influence program flow and redirect execution to attacker-controlled code.

Exploitation requires local access in the sense that the malicious file must be opened on the target system, but the payload itself can be delivered remotely through email, web downloads, or shared drives. Once triggered, the resulting code executes with the same privileges as the user running Acrobat. Refer to the Adobe Security Advisory APSB24-07 for vendor details.

Root Cause

The root cause is a memory management error classified as [CWE-416] Use After Free. Acrobat frees an internal object during PDF processing but retains a dangling pointer that is later dereferenced. When the freed region is reallocated with attacker-controlled data, the subsequent dereference yields control of a function pointer or virtual method dispatch.

Attack Vector

The attack vector is a malicious PDF file that a user must open in a vulnerable Acrobat or Acrobat Reader installation. Typical delivery channels include phishing emails with PDF attachments, drive-by downloads, and malicious documents hosted on file-sharing services. The vulnerability manifests during document parsing, before any explicit user action beyond opening the file.

No public proof-of-concept exploit is listed in Exploit-DB or CISA KEV at the time of writing. Vendors and defenders should still treat the issue as high priority given the widespread deployment of Acrobat Reader.

Detection Methods for CVE-2024-30304

Indicators of Compromise

Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, particularly command shells (cmd.exe, powershell.exe) or scripting hosts (wscript.exe, mshta.exe)
PDF files sourced from untrusted email attachments or downloads that trigger crashes or repeated relaunches of Acrobat
Outbound network connections initiated by Acrobat processes to previously unseen domains or IP addresses
New executable or DLL files written to %TEMP%, %APPDATA%, or user profile directories shortly after a PDF is opened

Detection Strategies

Hunt for process lineage where Acrobat.exe or AcroRd32.exe is the parent of interpreters, LOLBins, or unsigned binaries
Alert on Acrobat processes performing memory injection or writing to autorun locations in the Windows registry
Inspect PDF attachments at the mail gateway for embedded JavaScript, malformed cross-reference tables, or unusual object streams

Monitoring Recommendations

Enable EDR telemetry on all endpoints running Adobe Acrobat and forward events to a centralized data lake for retrospective hunting
Monitor Acrobat version telemetry across the estate and flag hosts still running vulnerable builds at or below 23.008.20470
Track exploit prediction data for CVE-2024-30304; the current EPSS probability is 0.562% at percentile 43.354

How to Mitigate CVE-2024-30304

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in Adobe Security Advisory APSB24-07
Inventory endpoints for vulnerable Acrobat versions on both Windows and macOS and prioritize patching of internet-facing and high-value users
Block or quarantine inbound PDF attachments from untrusted senders at the mail gateway pending remediation

Patch Information

Adobe released fixes as part of security bulletin APSB24-07. Windows and macOS administrators should deploy the updated Continuous and Classic track builds referenced in the advisory using Adobe Update Manager, SCCM, Intune, Jamf, or equivalent patch management tooling. Verify version numbers after deployment to confirm remediation.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Acrobat Reader to sandbox PDF rendering
Disable JavaScript execution in Acrobat via Edit > Preferences > JavaScript for user populations that do not require it
Restrict PDF handling to a hardened application or browser-based renderer for high-risk users until patches are applied

bash

# Configuration example: disable JavaScript in Adobe Acrobat Reader on Windows via registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f