CVE-2024-34122: Adobe Acrobat RCE Vulnerability

CVE-2024-34122 Overview

CVE-2024-34122 is an out-of-bounds read vulnerability affecting Adobe Acrobat for Microsoft Edge versions 126.0.2592.68 and earlier. The flaw occurs when the software parses a crafted file, allowing a read past the end of an allocated memory structure. An attacker can leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction because the victim must open a malicious file. The vulnerability is classified under CWE-125 (Out-of-Bounds Read).

Critical Impact
Successful exploitation enables arbitrary code execution in the current user's context, potentially leading to full compromise of the user session and access to sensitive documents.

Affected Products

Adobe Acrobat for Edge versions 126.0.2592.68 and earlier
Microsoft Edge (Chromium-based) with the Adobe Acrobat integration
Windows systems running vulnerable Edge builds with Acrobat PDF handling enabled

Discovery Timeline

2024-07-02 - CVE-2024-34122 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34122

Vulnerability Analysis

The vulnerability resides in the file-parsing logic of Adobe Acrobat for Edge. When the parser processes a crafted PDF or associated file structure, it reads memory beyond the bounds of an allocated buffer. This out-of-bounds read exposes adjacent memory contents to the parser's control flow.

Attackers can shape the crafted file so that the leaked data influences subsequent operations. This chain can bypass memory protections such as Address Space Layout Randomization (ASLR) and enable code execution in the current user's context. The vulnerability requires the victim to open the malicious file, so delivery typically occurs through phishing, malicious downloads, or drive-by attachments.

Root Cause

The root cause is missing or incorrect bounds validation during structured file parsing. The parser trusts a length or offset value derived from the untrusted file without verifying it against the actual allocated buffer size. This violation of [CWE-125] permits reading past the end of the memory structure, disclosing internal state and enabling further exploitation.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious file and delivers it to the target through email, web download, or another distribution channel. When the victim opens the file in Adobe Acrobat for Edge, the vulnerable parser processes the crafted content and triggers the out-of-bounds read. No verified proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified proof-of-concept code is publicly available for CVE-2024-34122.
// Refer to the Microsoft Security Update guide for authoritative technical details.

Detection Methods for CVE-2024-34122

Indicators of Compromise

Unexpected crashes of msedge.exe or Acrobat components immediately after opening a PDF file
PDF files arriving through email or downloads with abnormal structures or oversized cross-reference tables
Child processes spawned by Edge that execute shell, scripting, or LOLBin binaries following PDF interaction

Detection Strategies

Monitor endpoint telemetry for Edge or Acrobat processes launching unexpected children such as cmd.exe, powershell.exe, or rundll32.exe
Inspect PDF attachments at the mail gateway for malformed object streams and anomalous JavaScript embedded in the document
Correlate file-open events with subsequent memory access violations logged by Windows Error Reporting

Monitoring Recommendations

Enable process-lineage logging for msedge.exe and Acrobat plugin processes across managed endpoints
Alert on outbound network connections initiated by Edge shortly after a PDF file open event
Track Edge and Acrobat version inventories to identify hosts still running builds at or below 126.0.2592.68

How to Mitigate CVE-2024-34122

Immediate Actions Required

Update Microsoft Edge to a version later than 126.0.2592.68 on all managed endpoints
Restrict opening of PDF files from untrusted sources through email filtering and browser policy
Verify patch deployment using inventory tooling and enforce compliance for remote and roaming devices

Patch Information

Microsoft released a security update addressing CVE-2024-34122 through the standard Edge update channel. Refer to the Microsoft Security Update CVE-2024-34122 advisory for authoritative version details and rollout guidance. Enterprises using managed Edge deployments should confirm that automatic updates are enabled and that the affected build is no longer present in the environment.

Workarounds

Configure Group Policy to disable the Adobe Acrobat extension in Edge until patching completes
Route PDF handling to an alternate, patched viewer through file-association policy
Apply Attack Surface Reduction rules that block child process creation from browser processes

bash

# Verify installed Microsoft Edge version on Windows endpoints
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion

# Group Policy registry key to disable the Adobe Acrobat extension in Edge
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "elhekieabhbkpafcjcbbhbdmnfppghhc" /f