CVE-2024-34097: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34097 Overview

CVE-2024-34097 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. Versions 20.005.30574, 24.002.20736, and earlier contain the flaw across Windows and macOS platforms. Attackers can achieve arbitrary code execution in the context of the current user by crafting a malicious PDF file. Exploitation requires user interaction: the victim must open the malicious document. Adobe addressed the issue in security advisory APSB24-29.

Critical Impact
Successful exploitation leads to arbitrary code execution under the current user's privileges, enabling malware installation, data theft, or lateral movement from a single opened PDF.

Affected Products

Adobe Acrobat DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat Reader DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30574 and earlier on Windows and macOS

Discovery Timeline

2024-05-15 - CVE-2024-34097 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34097

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] within Adobe Acrobat and Acrobat Reader's PDF processing logic. Use After Free defects occur when a program continues to reference memory after it has been released back to the allocator. An attacker who can influence heap layout and trigger the dangling reference can substitute controlled data into the freed region. When the application later dereferences the stale pointer, execution flow can be redirected to attacker-controlled code. The attack requires local access in the sense that a user must open the file, but delivery vectors include email attachments, web downloads, and drive-by document opens.

Root Cause

The root cause is improper object lifetime management inside Acrobat's document parsing or JavaScript engine components. A specific object is freed while another code path retains a pointer to it, and that pointer is subsequently reused without validation. Adobe has not publicly disclosed the exact object type or code path affected by CVE-2024-34097.

Attack Vector

An attacker crafts a malicious PDF that triggers the Use After Free during parsing or interactive processing. The victim opens the file in a vulnerable Acrobat or Reader build. Once triggered, the attacker gains code execution with the privileges of the user running Acrobat. See the Adobe Security Advisory APSB24-29 for vendor details.

No public proof-of-concept or exploit code is currently available for CVE-2024-34097, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-34097

Indicators of Compromise

Unexpected Acrobat.exe or AcroRd32.exe child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Crashes of AcroRd32.exe or Acrobat.exe in Windows Event Log or macOS crash reports referencing access violations on freed memory
PDF files arriving via email or web downloads containing embedded JavaScript or unusual object streams
Outbound network connections initiated by Acrobat processes to previously unseen hosts

Detection Strategies

Monitor for anomalous process trees where Acrobat spawns interpreters or shells
Alert on Acrobat writing executable content (.exe, .dll, .js, .ps1) to user-writable paths such as %TEMP% or %APPDATA%
Correlate Acrobat crash telemetry with subsequent process creation or persistence events
Inspect inbound PDF attachments for suspicious JavaScript actions and malformed cross-reference tables

Monitoring Recommendations

Enable command-line and process-creation auditing (Windows Event ID 4688, Sysmon Event ID 1) on endpoints where Acrobat is installed
Ingest email gateway and web proxy logs to trace PDF delivery paths
Track Acrobat version inventory to identify hosts still running vulnerable builds

How to Mitigate CVE-2024-34097

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions released in Adobe advisory APSB24-29
Prioritize patching on endpoints that regularly process externally sourced PDFs, such as executive workstations and shared mailboxes
Block or quarantine inbound PDFs from untrusted senders at the email gateway pending patch deployment
Confirm that automatic updates are enabled in Acrobat's preferences

Patch Information

Adobe released fixed builds in security bulletin APSB24-29 on May 14, 2024. Administrators should deploy the updated Continuous track and Classic track versions to remediate CVE-2024-34097 on Windows and macOS.

Workarounds

Enable Protected View for all files from potentially unsafe locations under Acrobat's Enhanced Security settings
Disable JavaScript in Acrobat via Edit > Preferences > JavaScript to reduce PDF-based attack surface
Restrict Acrobat's ability to launch child processes using application allowlisting or endpoint policy
Route PDF handling for untrusted files through a sandboxed viewer until patching completes

bash

# Windows registry example: disable Acrobat JavaScript enterprise-wide
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Enforce Protected View for all files
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f