CVE-2024-34096: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34096 Overview

CVE-2024-34096 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts versions 20.005.30574, 24.002.20736, and earlier on both Windows and macOS platforms. An attacker who successfully exploits this issue can achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious PDF file crafted by the attacker. Adobe released a security patch addressing this vulnerability as part of security bulletin APSB24-29.

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the user opening the malicious PDF, enabling malware installation, data theft, or lateral movement.

Affected Products

Adobe Acrobat DC (Continuous track) — versions 24.002.20736 and earlier
Adobe Acrobat Reader DC (Continuous track) — versions 24.002.20736 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) — versions 20.005.30574 and earlier on Microsoft Windows and Apple macOS

Discovery Timeline

2024-05-15 - CVE-2024-34096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34096

Vulnerability Analysis

CVE-2024-34096 is a Use After Free condition [CWE-416] in Adobe Acrobat and Acrobat Reader. The vulnerability arises when the application continues to reference memory after that memory has been freed. When the freed allocation is reclaimed and populated with attacker-controlled data, the dangling pointer dereference can be steered to redirect execution flow. This class of memory corruption bug in a PDF parser is commonly weaponized through malformed objects, JavaScript actions, or crafted embedded content that manipulates object lifetimes. Because Acrobat processes complex, untrusted document content, a single malicious file is sufficient to trigger the flaw.

Root Cause

The root cause is improper object lifetime management within Acrobat's document processing routines. A code path releases an object while other references to it remain valid, leaving a dangling pointer that is later dereferenced during document rendering or scripting. Adobe has not publicly disclosed the specific component or function affected.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a specially crafted PDF via email, a website, an instant message, or shared storage. When the victim opens the file in a vulnerable Acrobat or Reader build, the parser triggers the use-after-free condition, allowing the attacker to execute code in the user's security context. No authentication is required on the target system, and the exploit runs at the current user's privilege level.

No public proof-of-concept exploit or in-the-wild activity has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Adobe security bulletin APSB24-29 for vendor-provided technical context.

Detection Methods for CVE-2024-34096

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe, AcroRd32.exe, or AdobeAcrobat on macOS, such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters.
Acrobat process crashes with access violations shortly after opening a PDF, which may indicate exploitation attempts or failed exploitation.
Outbound network connections initiated by Acrobat to unfamiliar hosts following PDF open events.
PDF files sourced from untrusted email attachments or drive-by downloads that reference JavaScript actions or unusual embedded objects.

Detection Strategies

Deploy behavioral endpoint identification rules that flag Acrobat processes spawning script interpreters or command shells.
Correlate PDF open events with subsequent file write, registry modification, or persistence activity on the same host.
Ingest application crash telemetry (Windows Error Reporting, macOS crash logs) and alert on repeated Acrobat faults with heap-corruption signatures.

Monitoring Recommendations

Monitor Acrobat and Reader version telemetry across the fleet to confirm patched builds are deployed.
Track email gateway and web proxy logs for PDF attachments originating from external, low-reputation senders.
Enable process command-line logging on endpoints to capture child-process arguments spawned from Acrobat.

How to Mitigate CVE-2024-34096

Immediate Actions Required

Update Adobe Acrobat and Reader (both Continuous and Classic tracks) to the fixed versions listed in Adobe security bulletin APSB24-29 on all Windows and macOS endpoints.
Inventory all installations of Acrobat DC and Acrobat Reader DC and prioritize patching for users who routinely open externally sourced PDFs.
Restrict execution of PDFs from untrusted sources through email gateway policies and web content filtering.

Patch Information

Adobe addressed CVE-2024-34096 in the security update documented in the Adobe Acrobat Security Bulletin APSB24-29. Administrators should install the vendor-provided update on all affected Continuous and Classic track builds across Windows and macOS.

Workarounds

Enable Adobe Acrobat's Protected View and Protected Mode to sandbox PDF rendering and limit the impact of exploitation.
Disable JavaScript execution within Acrobat (Preferences > JavaScript > Enable Acrobat JavaScript unchecked) to reduce the attack surface exposed by malicious documents.
Configure email security to strip or quarantine PDF attachments from untrusted senders until patching is complete.

bash

# Windows registry example: disable Acrobat JavaScript as a temporary hardening measure
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Verify installed Acrobat Reader version on Windows
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer' | Select-Object -ExpandProperty ProductVersion"