CVE-2024-34099: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34099 Overview

CVE-2024-34099 is an Improper Access Control vulnerability [CWE-284] affecting Adobe Acrobat and Acrobat Reader. Adobe Acrobat Reader versions 20.005.30574, 24.002.20736, and earlier contain the flaw on both Windows and macOS. Successful exploitation allows arbitrary code execution in the context of the current user. The attack vector is local and requires user interaction: a victim must open a malicious PDF file crafted by the attacker. Adobe published Security Advisory APSB24-29 on May 14, 2024, addressing this issue alongside related Acrobat vulnerabilities.

Critical Impact
Attackers who convince a user to open a crafted PDF can execute arbitrary code with the privileges of the current user, potentially leading to full workstation compromise.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) prior to 24.002.20759
Adobe Acrobat and Acrobat Reader 2020 (Classic track) prior to 20.005.30635
Windows and macOS installations of the affected Acrobat versions

Discovery Timeline

2024-05-15 - CVE-2024-34099 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34099

Vulnerability Analysis

The vulnerability stems from improper access control [CWE-284] within the Acrobat and Acrobat Reader parsing and rendering pipeline. The affected component fails to enforce restrictions on privileged operations when handling attacker-controlled content embedded in a PDF document.

When a victim opens a malicious file, the flaw permits code paths that should be gated by access checks to execute untrusted logic. Adobe classifies the outcome as arbitrary code execution in the context of the current user. On typical workstation deployments, this equates to code execution with interactive user rights, enabling credential theft, persistence, and lateral movement.

Adobe does not disclose the specific internal component in its advisory. The issue is tracked in Adobe Security Advisory APSB24-29 with a priority rating consistent with a client-side code execution flaw requiring user interaction.

Root Cause

The root cause is missing or insufficient access control on an operation reachable from parsed PDF content. Because the check is absent or improperly implemented, attacker-controlled data crosses a trust boundary and reaches sensitive execution paths inside the Acrobat process.

Attack Vector

Exploitation requires local delivery of a malicious PDF and user interaction to open it. Delivery typically occurs through phishing email attachments, drive-by downloads, or messaging platforms. Once the PDF opens in a vulnerable Acrobat or Reader build, the embedded payload triggers the access-control failure and executes code under the victim's account.

No public proof-of-concept exploit and no CISA KEV listing are recorded for this CVE. See Adobe Security Advisory APSB24-29 for vendor technical details.

Detection Methods for CVE-2024-34099

Indicators of Compromise

Acrobat or Reader processes (AcroRd32.exe, Acrobat.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
PDF files delivered via email or web download that trigger unexpected outbound network connections when opened
Creation of executable files or scripts in user-writable directories immediately after a PDF is opened
Unexpected DLL loads or module injection into Acrobat processes originating from temporary or user profile paths

Detection Strategies

Hunt for Acrobat-parented process trees invoking scripting engines or LOLBins, which are anomalous for normal document viewing
Correlate PDF file opens with subsequent registry Run key modifications, scheduled task creation, or WMI persistence events
Deploy YARA rules targeting suspicious JavaScript, embedded objects, or malformed cross-reference tables inside PDF payloads observed in this campaign class

Monitoring Recommendations

Enable command-line and process-creation logging (Windows Event ID 4688, Sysmon Event ID 1) on endpoints running Acrobat or Reader
Monitor Acrobat installations for out-of-date versions using vulnerability management scans against the fixed builds in APSB24-29
Alert on Acrobat processes making outbound network connections to non-Adobe infrastructure

How to Mitigate CVE-2024-34099

Immediate Actions Required

Update Adobe Acrobat DC and Reader DC (Continuous) to 24.002.20759 or later on both Windows and macOS
Update Adobe Acrobat 2020 and Reader 2020 (Classic) to 20.005.30635 or later
Inventory endpoints for vulnerable Acrobat builds and prioritize patching for users who routinely handle external PDFs
Reinforce user awareness training on opening PDF attachments from unverified senders

Patch Information

Adobe released fixed builds in Adobe Security Advisory APSB24-29 on May 14, 2024. Administrators should deploy the patched versions through Adobe Update Server, SCCM, Intune, Jamf, or equivalent management tooling. Verify installed versions with Help > About Adobe Acrobat or through registry and plist inspection.

Workarounds

Enable Adobe Acrobat Protected View for files originating from the internet and untrusted locations
Disable JavaScript in Acrobat and Reader via Edit > Preferences > JavaScript where PDF JavaScript is not required for business workflows
Restrict PDF handlers to the patched Acrobat build and remove legacy or unmanaged Acrobat installations
Apply application allowlisting to block Acrobat from spawning scripting interpreters and command shells

bash

# Configuration example: disable Acrobat JavaScript via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f