CVE-2024-30306: Adobe Acrobat RCE Vulnerability

CVE-2024-30306 Overview

CVE-2024-30306 is an out-of-bounds read vulnerability affecting Adobe Acrobat and Adobe Acrobat Reader. The flaw exists in the file parsing logic and allows an attacker to read memory past the end of an allocated structure when a crafted document is opened. Successful exploitation can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file delivered through email, web download, or another social engineering vector. Affected products include Acrobat and Acrobat Reader versions 20.005.30539, 23.008.20470, and earlier on both Microsoft Windows and Apple macOS.

Critical Impact
An attacker can achieve local code execution as the current user by delivering a malicious PDF that triggers an out-of-bounds read during parsing.

Affected Products

Adobe Acrobat and Acrobat DC (Classic and Continuous tracks) versions 20.005.30539, 23.008.20470 and earlier
Adobe Acrobat Reader and Acrobat Reader DC (Classic and Continuous tracks) versions 20.005.30539, 23.008.20470 and earlier
Microsoft Windows and Apple macOS installations of the affected Adobe products

Discovery Timeline

2024-05-02 - CVE-2024-30306 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30306

Vulnerability Analysis

CVE-2024-30306 is classified as an out-of-bounds read [CWE-125] in the document parsing code of Adobe Acrobat and Acrobat Reader. When the application processes a specially crafted file, the parser reads bytes beyond the boundary of an allocated memory structure. This condition can expose adjacent heap contents and, depending on how the leaked data is used downstream, corrupt control-flow state that leads to arbitrary code execution. The issue is local and user-triggered: the attacker cannot exploit it remotely without convincing a user to open the file. Because Acrobat and Reader are commonly used to open documents received by email or downloaded from the web, the practical attack surface is broad even though the vector is local.

Root Cause

The root cause is missing or insufficient bounds validation during parsing of an attacker-controlled file structure. The parser trusts a length or offset field derived from the input and dereferences memory outside the allocated buffer. Adobe has not published field-level technical detail; refer to the Adobe Acrobat Security Advisory APSB24-07 for vendor guidance.

Attack Vector

An attacker crafts a malicious PDF or related document that embeds the malformed structure. The attacker delivers the file through phishing, drive-by download, shared storage, or messaging. When the victim opens the document in a vulnerable Acrobat or Reader build, the parser performs the out-of-bounds read and the attacker gains code execution with the privileges of the current user. No authentication is required, and no privileged access on the target host is needed.

No verified public proof-of-concept exploit is available for CVE-2024-30306. See the vendor advisory for technical context.

Detection Methods for CVE-2024-30306

Indicators of Compromise

Acrobat or Reader processes (Acrobat.exe, AcroRd32.exe) spawning shells, script interpreters, or rundll32.exe shortly after opening a document
Unexpected child processes writing to %APPDATA%, %TEMP%, or user profile directories following a PDF open event
Outbound network connections from Acrobat or Reader to previously unseen domains immediately after document rendering
Crash or exception events in Acrobat or Reader referencing access violations during file parsing

Detection Strategies

Hunt for parent-child process anomalies where Acrobat or Reader is the parent of cmd.exe, powershell.exe, wscript.exe, or cscript.exe
Alert on PDF files that arrive by email and are opened by users with software versions at or below 20.005.30539 or 23.008.20470
Correlate Windows Error Reporting or macOS crash reports for Acrobat modules with subsequent process-creation activity on the same host

Monitoring Recommendations

Inventory Acrobat and Reader versions across managed endpoints and flag hosts running vulnerable builds
Ingest endpoint process, file, and network telemetry into a centralized data lake for cross-source correlation and retrospective hunting
Monitor email gateways for PDF attachments and enable sandbox detonation for documents originating from external senders

How to Mitigate CVE-2024-30306

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in Adobe Security Bulletin APSB24-07
Identify hosts running versions at or below 20.005.30539 (Classic) and 23.008.20470 (Continuous) and prioritize them for patching
Instruct users to avoid opening PDF documents from untrusted senders until patching is complete

Patch Information

Adobe addressed CVE-2024-30306 in the security updates described in APSB24-07. Apply the vendor-supplied updates for both the Classic and Continuous tracks on Windows and macOS. Enterprise deployments should push updates through existing patch management tooling and verify the installed build number after deployment.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Reader to sandbox document rendering
Block or quarantine PDF attachments from external senders at the email gateway until endpoints are patched
Restrict Acrobat and Reader from spawning child processes using application control or endpoint policy
Remove or disable Acrobat and Reader on systems that do not require PDF authoring or advanced rendering

bash

# Example: verify installed Acrobat Reader DC version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer" /v VersionMajor
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer" /v VersionMinor

# Confirm the build is at or above the version listed in APSB24-07