CVE-2024-34100: Adobe Acrobat DC RCE Vulnerability

CVE-2024-34100 Overview

CVE-2024-34100 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts Acrobat Reader versions 20.005.30574, 24.002.20736, and earlier releases on both Windows and macOS. Successful exploitation allows arbitrary code execution in the context of the current user. The attack requires local access and user interaction, since a victim must open a crafted PDF document. Adobe published the security advisory on May 14, 2024, and the vulnerability was added to the National Vulnerability Database (NVD) shortly after.

Critical Impact
A crafted PDF file can trigger arbitrary code execution with the privileges of the user opening the document, enabling malware deployment and lateral movement from client endpoints.

Affected Products

Adobe Acrobat DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat Reader DC (Continuous track) versions 24.002.20736 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30574 and earlier on Windows and macOS

Discovery Timeline

2024-05-15 - CVE-2024-34100 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34100

Vulnerability Analysis

CVE-2024-34100 is a Use After Free (UAF) condition in Adobe Acrobat and Acrobat Reader. A UAF flaw occurs when a program continues to reference memory after that memory has been freed. When the freed region is reallocated and populated with attacker-controlled data, subsequent access to the dangling pointer redirects execution flow. In Acrobat, parsing logic for embedded PDF objects can hold a pointer to an object whose backing memory is released during processing.

An attacker crafts a PDF that triggers the specific sequence of object creation, release, and subsequent reuse. When Acrobat dereferences the stale pointer, the attacker gains control over a virtual function call or object method dispatch. This grants code execution at the privilege level of the interactive user.

Root Cause

The root cause is improper lifetime management of a heap-allocated object during PDF document processing. Acrobat frees the object but retains a reference used later in the parsing pipeline. Adobe classifies the weakness under [CWE-416: Use After Free].

Attack Vector

Exploitation requires local delivery of a malicious PDF and user interaction to open it. Common delivery paths include phishing email attachments, drive-by downloads, and shared file repositories. No prior authentication to the target system is required beyond opening the document. Once opened, the exploit executes in-process within Acrobat, bypassing perimeter defenses that inspect only network traffic. See the Adobe Acrobat Security Advisory APSB24-29 for vendor technical context.

Detection Methods for CVE-2024-34100

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Acrobat process crashes with access violation exceptions in modules handling PDF object parsing
PDF files containing malformed object streams, unusual JavaScript payloads, or heap-spray patterns
Outbound network connections initiated by Acrobat processes to previously unseen domains or IPs

Detection Strategies

Monitor endpoint telemetry for anomalous parent-child process relationships originating from Acrobat binaries
Alert on memory access violations and exception events within Acrobat modules through EDR crash telemetry
Inspect PDF attachments at the mail gateway for embedded JavaScript and suspicious object dictionaries
Correlate file open events on .pdf documents with subsequent process creation and network activity

Monitoring Recommendations

Baseline normal Acrobat behavior in your environment and flag deviations such as script host invocation
Ingest Windows Defender Exploit Guard and macOS crash reports into a centralized data lake for hunting
Track installed Acrobat versions across the fleet and alert on hosts running vulnerable builds
Enable command-line and script-block logging to capture post-exploitation activity following PDF opens

How to Mitigate CVE-2024-34100

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the patched versions identified in Adobe APSB24-29
Inventory all endpoints running Acrobat DC or Classic track builds and prioritize patching of user workstations
Restrict execution of Acrobat child processes through application control policies
Educate users to avoid opening PDF attachments from untrusted or unexpected sources

Patch Information

Adobe released fixed builds in advisory APSB24-29. Continuous track users should upgrade beyond 24.002.20736, and Classic track users should upgrade beyond 20.005.30574. Apply the update through Adobe's built-in updater, enterprise deployment tools, or the Adobe download center. Verify the installed version after patching by checking Help > About Adobe Acrobat.

Workarounds

Enable Protected View and Protected Mode in Acrobat preferences to sandbox PDF rendering
Disable JavaScript execution within Acrobat under Preferences > JavaScript for environments that do not require it
Configure Attack Surface Reduction rules on Windows to block Office and reader applications from spawning child processes
Route inbound PDF attachments through a sandbox detonation service before delivery to end users

bash

# Windows: query installed Acrobat version via registry
reg query "HKLM\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer" /v "VersionMax"

# macOS: check installed Acrobat Reader version
defaults read "/Applications/Adobe Acrobat Reader.app/Contents/Info.plist" CFBundleShortVersionString

# Disable JavaScript in Acrobat via registry (Windows)
reg add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f