CVE-2024-34098: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34098 Overview

CVE-2024-34098 is an improper input validation vulnerability [CWE-20] in Adobe Acrobat and Adobe Acrobat Reader. Affected versions include 20.005.30574, 24.002.20736, and earlier releases across both Continuous and Classic tracks. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. The flaw requires user interaction: the victim must open a crafted malicious file. Adobe published fixes in security bulletin APSB24-29 on May 14, 2024. The vulnerability affects deployments on Microsoft Windows and Apple macOS.

Critical Impact

Attackers who trick a user into opening a malicious PDF can achieve arbitrary code execution with the privileges of the current user.

Affected Products

• Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 24.002.20736 and earlier
• Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30574 and earlier
• Windows and macOS installations of the affected Acrobat products

Discovery Timeline

• 2024-05-15 - CVE-2024-34098 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34098

Vulnerability Analysis

CVE-2024-34098 is classified as an Improper Input Validation issue [CWE-20] in Adobe Acrobat and Acrobat Reader. Acrobat parses complex PDF structures including embedded objects, streams, JavaScript, and font data. When the parser accepts malformed or unexpected input without proper validation, it can reach code paths that operate on corrupted state. This condition can lead to arbitrary code execution in the process context of the user opening the document. Because Acrobat is widely deployed on end-user endpoints, attackers use it as an initial access vector through phishing lures and drive-by downloads. The EPSS probability for exploitation currently sits in the lower range, but Adobe Reader flaws with similar profiles have historically been weaponized in targeted campaigns.

Root Cause

The root cause is missing or insufficient validation of input data processed by Acrobat when handling a crafted file. Adobe has not published detailed technical internals for this issue. Refer to the Adobe Security Advisory APSB24-29 for vendor-authored technical context.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious PDF through email attachments, chat platforms, malicious websites, or removable media. When the victim opens the file in a vulnerable Acrobat or Reader build, the malformed content triggers the flaw and executes attacker-controlled code with the user's privileges. No authentication to any Adobe service is required. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2024-34098

Indicators of Compromise

• Unexpected child processes spawned from AcroRd32.exe or Acrobat.exe, such as cmd.exe, powershell.exe, or wscript.exe.
• Acrobat processes writing executables, scripts, or DLLs to user-writable directories like %APPDATA%, %TEMP%, or ~/Library/Caches.
• Outbound network connections initiated by Acrobat to previously unseen domains or IP addresses shortly after a PDF is opened.
• PDF files sourced from external email or download links that fail structural validation in a sandboxed parser.

Detection Strategies

• Deploy behavioral endpoint identification rules that flag Acrobat processes performing code execution, injection, or persistence actions.
• Inspect email attachments and web downloads with a PDF-aware sandbox to observe process, file, and network behavior before delivery.
• Correlate document-open telemetry with subsequent process, file, and network events to reconstruct suspicious execution chains.

Monitoring Recommendations

• Log and alert on process creation events where the parent image is Acrobat.exe or AcroRd32.exe and the child image is a scripting or shell interpreter.
• Monitor Acrobat's file write operations to autorun locations, startup folders, and scheduled task directories.
• Track Acrobat version inventory across the fleet and alert on hosts still running builds at or below 24.002.20736 (Continuous) or 20.005.30574 (Classic).

How to Mitigate CVE-2024-34098

Immediate Actions Required

• Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in Adobe bulletin APSB24-29 on all Windows and macOS endpoints.
• Prioritize patching for users who routinely open PDFs from external senders, including finance, HR, legal, and executive staff.
• Instruct users to avoid opening unexpected PDF attachments and to report suspicious documents to the security team.

Patch Information

Adobe released fixes in bulletin APSB24-29. Continuous track users must upgrade beyond 24.002.20736, and Classic track users must upgrade beyond 20.005.30574. See the Adobe Security Advisory APSB24-29 for the current fixed version numbers and download locations.

Workarounds

• Enable Acrobat's Protected View and Protected Mode to constrain the process sandbox for documents from untrusted sources.
• Disable JavaScript in Acrobat via Preferences > JavaScript where business workflows do not require it.
• Block execution of child processes from Acrobat using endpoint policy or Windows Defender Application Control rules.

# Example: disable Acrobat JavaScript via registry on Windows
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f