CVE-2024-34095: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34095 Overview

CVE-2024-34095 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. Adobe Acrobat Reader versions 20.005.30574, 24.002.20736, and earlier contain a memory corruption flaw that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a crafted malicious PDF file. The vulnerability affects both Windows and macOS installations of Adobe Acrobat DC, Acrobat Reader DC, Acrobat Classic, and Acrobat Reader Classic tracks. Adobe published the fix in security bulletin APSB24-29.

Critical Impact
Successful exploitation allows arbitrary code execution with the privileges of the user running Acrobat, providing an initial access vector via weaponized PDF documents.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30574 and earlier
Deployments on Microsoft Windows and Apple macOS

Discovery Timeline

2024-05-15 - CVE-2024-34095 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34095

Vulnerability Analysis

The issue is a Use After Free condition in Adobe Acrobat and Acrobat Reader. Use After Free vulnerabilities occur when a program continues to reference memory after that memory has been freed. An attacker who controls the contents of the reallocated memory region can influence program flow when the dangling pointer is dereferenced. In Acrobat, PDF parsing and JavaScript-driven object lifecycles are common sources of such flaws. When triggered, the freed object can be replaced with attacker-controlled data, enabling function pointer or virtual table hijacking.

Root Cause

The root cause is improper object lifetime management within Acrobat's PDF processing components. An object is freed while another code path retains a reference to it. Subsequent access to that dangling reference reads or writes memory that the allocator has since reassigned. This condition maps to [CWE-416: Use After Free].

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious PDF document and delivers it via email, web download, chat, or a compromised file share. When the victim opens the file in a vulnerable Acrobat or Reader build, the embedded content triggers the Use After Free condition. The resulting code executes with the privileges of the current user, enabling malware staging, credential theft, or lateral movement.

No public proof-of-concept has been catalogued in Exploit-DB and the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical exploitation details are described in the Adobe Acrobat Security Advisory APSB24-29.

Detection Methods for CVE-2024-34095

Indicators of Compromise

Acrobat or Reader processes (Acrobat.exe, AcroRd32.exe) spawning shells, scripting hosts, or LOLBins such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Unexpected child processes writing executables or scripts to %APPDATA%, %TEMP%, or user profile directories
Acrobat crashes with access violations logged in Windows Application Event Log shortly after opening a PDF
Outbound network connections initiated by Acrobat to previously unseen domains or IP addresses

Detection Strategies

Hunt for PDF documents opened from email attachments or browser downloads immediately followed by anomalous Acrobat child processes
Monitor for memory-corruption crash signatures in Acrobat process telemetry, including heap corruption exceptions
Correlate file-write events under user directories with the parent process Acrobat.exe or AcroRd32.exe

Monitoring Recommendations

Enable process command-line logging and script block logging on endpoints that handle external PDF documents
Track Acrobat version inventory across the estate to identify unpatched hosts running 24.002.20736 or 20.005.30574 and earlier
Alert on any Acrobat process establishing outbound connections to non-Adobe infrastructure

How to Mitigate CVE-2024-34095

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions published in Adobe security bulletin APSB24-29
Inventory all Windows and macOS endpoints running Acrobat DC or Acrobat Classic and prioritize patching for users who process external PDFs
Restrict opening of PDFs from untrusted sources through email gateway policy and browser controls

Patch Information

Adobe addressed CVE-2024-34095 in the May 14, 2024 security update tracked as APSB24-29. Administrators should deploy the updated Continuous track (post-24.002.20736) and Classic track (post-20.005.30574) builds across all Windows and macOS endpoints. Full details are available in the Adobe Acrobat Security Advisory.

Workarounds

Enable Adobe Acrobat Protected View and Protected Mode to sandbox untrusted PDF rendering
Disable JavaScript execution within Acrobat via Preferences > JavaScript > Enable Acrobat JavaScript to reduce the attack surface
Use group policy or configuration profiles to block execution of child processes from Acrobat where feasible

bash

# Configuration example: disable Acrobat JavaScript via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f