CVE-2024-34094: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34094 Overview

CVE-2024-34094 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts Acrobat Reader versions 20.005.30574, 24.002.20736, and earlier on both Windows and macOS platforms. An attacker who successfully exploits this issue can execute arbitrary code in the context of the current user. Exploitation requires user interaction, specifically that a victim opens a crafted malicious PDF file. Adobe published fixes in security bulletin APSB24-29.

Critical Impact
Successful exploitation leads to arbitrary code execution with the privileges of the user opening the malicious PDF, enabling initial access, malware deployment, or lateral movement.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30574 and earlier
Deployments on Microsoft Windows and Apple macOS

Discovery Timeline

2024-05-15 - CVE-2024-34094 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34094

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] in Adobe Acrobat and Acrobat Reader. Use After Free flaws occur when a program continues to reference memory after it has been released back to the allocator. When Acrobat later dereferences the stale pointer, an attacker who controls the freed region can direct execution flow. In PDF processing, these conditions typically arise during JavaScript execution, annotation handling, or object lifecycle management within the rendering engine.

The issue requires user interaction. A victim must open a malicious PDF crafted to trigger the vulnerable code path. Because Acrobat runs the file with the interactive user's privileges, code execution occurs under that user context. On systems where the victim runs as an administrator, the impact extends to the operating system level.

Root Cause

The root cause is improper object lifetime management within Acrobat's PDF parsing and rendering logic. A referenced object is freed while another pointer to it remains reachable. Subsequent operations dereference the freed memory, and attacker-controlled data placed at the same allocation slot influences control flow.

Attack Vector

The attack vector is local and file-based. An attacker delivers a weaponized PDF through email, chat platforms, drive-by download, or shared storage. When the target opens the document in a vulnerable Acrobat build, the crafted objects trigger the Use After Free and hand execution to attacker-supplied logic. No network authentication is required, but the attack fails without user action.

Vulnerability mechanism (prose description):
1. Malicious PDF references an internal object (annotation, form field, or scripted object).
2. Processing logic releases the underlying allocation while a dangling reference persists.
3. Crafted content re-occupies the freed slot with attacker-controlled data.
4. A later dereference of the stale pointer transfers control, enabling arbitrary code execution
   in the context of the current user.

See the Adobe advisory APSB24-29 for vendor details.

Detection Methods for CVE-2024-34094

Indicators of Compromise

PDF files opened from untrusted sources immediately followed by child processes spawned from AcroRd32.exe or Acrobat.exe (for example, cmd.exe, powershell.exe, rundll32.exe).
Unexpected network connections initiated by Acrobat processes to external hosts.
Crash events or Windows Error Reporting entries citing access violations inside Acrobat modules.
Newly written executables, DLLs, or scripts in user-writable directories following a PDF open event.

Detection Strategies

Alert on Acrobat spawning shell interpreters, script hosts, or LOLBins, which is uncommon in normal document viewing.
Hunt for PDF files delivered through email that exceed typical size or contain embedded JavaScript, /OpenAction, or /AA entries.
Correlate Acrobat crash telemetry with subsequent process creation or persistence artifacts on the same host.

Monitoring Recommendations

Ingest endpoint process creation, module load, and file write events into your SIEM to build parent-child chains from Acrobat processes.
Track Acrobat and Reader version inventory to identify hosts still running builds at or below 24.002.20736 and 20.005.30574.
Monitor email and web gateway telemetry for PDF attachments from external senders and unclassified URLs.

How to Mitigate CVE-2024-34094

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the versions listed in Adobe Security Bulletin APSB24-29.
Prioritize patching for users who routinely open PDFs from external senders, including finance, HR, and executive staff.
Restrict local administrator rights so that exploitation runs in a reduced-privilege context.

Patch Information

Adobe addressed CVE-2024-34094 in the May 2024 security update tracked under APSB24-29. Administrators should deploy the fixed Continuous and Classic track builds documented in the Adobe Acrobat Security Advisory. Enable automatic updates in Acrobat where feasible to reduce the exposure window on unmanaged endpoints.

Workarounds

Enable Acrobat Protected View for files originating from the internet and other untrusted locations.
Disable JavaScript execution in Acrobat and Reader through the Preferences UI or enterprise policy until patches are deployed.
Block or quarantine inbound PDFs at the mail gateway when they contain embedded JavaScript or auto-action entries.
Associate the .pdf extension with a sandboxed viewer on high-risk endpoints until patching completes.

bash

# Windows: enforce Acrobat Protected View and disable JavaScript via registry
# Apply to HKLM for machine-wide enforcement on managed endpoints
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" ^
  /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" ^
  /v iProtectedView /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" ^
  /v bDisableJavaScript /t REG_DWORD /d 1 /f