CVE-2024-30305: Adobe Acrobat RCE Vulnerability

CVE-2024-30305 Overview

CVE-2024-30305 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts versions 20.005.30539, 23.008.20470 and earlier releases across both Classic and Continuous tracks. An attacker who convinces a user to open a crafted PDF file can execute arbitrary code in the context of the current user. The issue affects installations on both Microsoft Windows and Apple macOS. Adobe published a fix in security bulletin APSB24-07.

Critical Impact
Successful exploitation allows arbitrary code execution with the privileges of the user opening a malicious PDF, providing attackers a foothold for further compromise.

Affected Products

Adobe Acrobat and Acrobat DC (Classic and Continuous tracks) through 20.005.30539 and 23.008.20470
Adobe Acrobat Reader and Acrobat Reader DC (Classic and Continuous tracks) through 20.005.30539 and 23.008.20470
Installations on Microsoft Windows and Apple macOS

Discovery Timeline

2024-05-02 - CVE-2024-30305 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30305

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat and Acrobat Reader. Use After Free flaws occur when a program continues to reference memory after that memory has been freed. An attacker who controls the reallocation of the freed region can influence the data that the dangling pointer references. When Acrobat later dereferences the stale pointer, attacker-controlled data can be interpreted as a valid object, leading to arbitrary code execution in the context of the current user.

Root Cause

The root cause is improper object lifetime management within the PDF parsing and rendering pipeline. A specific object is freed while another code path still holds a reference to it. Parsing a malicious PDF triggers the dangling reference and causes the process to operate on freed memory. See the Adobe Security Advisory APSB24-07 for vendor details.

Attack Vector

Exploitation requires user interaction. A victim must open a specially crafted PDF document delivered through email, a web download, or a shared file location. The attack vector is local because the malicious file must be processed by the local Acrobat installation, but delivery is trivial through standard social engineering. Successful exploitation yields code execution at the privilege level of the current user.

No public proof-of-concept code has been verified for this issue. Technical exploitation details are described in prose only; refer to the vendor advisory for authoritative information.

Detection Methods for CVE-2024-30305

Indicators of Compromise

Unexpected child processes spawned by AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Acrobat processes making outbound network connections to unfamiliar hosts shortly after a PDF is opened
Crashes or abnormal exits of Acrobat processes coinciding with the delivery of a new PDF attachment
Writes to disk of executable content or scripts from Acrobat process contexts

Detection Strategies

Hunt for process ancestry where Acrobat spawns shell or scripting interpreters, a pattern uncommon in normal document workflows
Correlate email or web download telemetry with subsequent Acrobat crashes to surface potentially malicious PDFs
Inspect PDFs statically for anomalous object streams, JavaScript actions, or malformed cross-reference tables that trigger the parser

Monitoring Recommendations

Enable detailed process creation logging on endpoints running Acrobat and forward events to a centralized analytics platform
Alert on Acrobat writing to auto-run locations, scheduled tasks, or startup folders
Track outbound connections initiated by Acrobat processes and baseline expected destinations

How to Mitigate CVE-2024-30305

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in Adobe Security Advisory APSB24-07
Inventory all endpoints running Acrobat or Acrobat Reader across Windows and macOS and prioritize patching
Restrict execution of PDF files from untrusted sources through email filtering and web gateway controls
Enable Protected View and Protected Mode in Acrobat to reduce the impact of malicious documents

Patch Information

Adobe released fixed builds addressing this issue as documented in Adobe Security Advisory APSB24-07. Apply the vendor-provided updates for both the Classic and Continuous tracks of Acrobat, Acrobat DC, Acrobat Reader, and Acrobat Reader DC on Windows and macOS.

Workarounds

Disable JavaScript in Acrobat via Preferences > JavaScript > Enable Acrobat JavaScript where compatible with business use
Block or quarantine inbound PDF attachments from external senders at the email gateway until patching is complete
Deploy application allowlisting to prevent Acrobat from spawning shell interpreters or writing executables

bash

# Configuration example: disable JavaScript in Acrobat Reader via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f