CVE-2024-49535 Overview
CVE-2024-49535 is an XML External Entity (XXE) vulnerability affecting Adobe Acrobat and Acrobat Reader. The flaw allows an attacker to supply malicious XML input that references an external entity, enabling unauthorized read access to data outside the Acrobat sandbox. Exploitation requires user interaction, where the victim must process a crafted XML document. Affected versions include Acrobat Reader 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710, and earlier releases on both Windows and macOS. Adobe addressed the issue in its December 2024 security advisory APSB24-92. The vulnerability is categorized under [CWE-611] Improper Restriction of XML External Entity Reference.
Critical Impact
Successful exploitation allows attackers to read sensitive files and data outside the Acrobat sandbox via crafted XML documents.
Affected Products
- Adobe Acrobat (Classic and Continuous tracks)
- Adobe Acrobat Reader and Acrobat Reader DC
- Microsoft Windows and Apple macOS installations of the affected Acrobat versions
Discovery Timeline
- 2024-12-10 - CVE-2024-49535 published to NVD
- 2025-01-23 - Last updated in NVD database
Technical Details for CVE-2024-49535
Vulnerability Analysis
The vulnerability stems from improper restriction of XML External Entity references in Adobe Acrobat and Reader's XML parsing logic. When Acrobat processes an XML document that contains an external entity declaration, the parser resolves the referenced resource without sufficient validation. An attacker can craft an XML payload whose DOCTYPE declaration includes an external entity pointing to local files or network resources. Resolving these entities can expose data from outside the Acrobat sandbox boundary.
The attack vector is Local, and user interaction is required because a victim must open or process the malicious XML document. The confidentiality impact is High while integrity and availability are unaffected, reflecting the read-only nature of XXE data exfiltration in this context. The scope is Changed, meaning the breach impacts resources beyond the vulnerable component's security authority.
Root Cause
The root cause is an unsafe default configuration in the XML parser used by Acrobat. The parser allows external entity resolution rather than disabling DOCTYPE declarations and external general entities by default. This permits documents to reference and load arbitrary external resources during parsing.
Attack Vector
An attacker delivers a malicious XML file or a PDF embedding XML data. The victim opens the document in a vulnerable Acrobat or Reader build. During parsing, the embedded external entity reference is resolved, returning file contents into the document context where the attacker can extract them. The exploit does not require elevated privileges but does require a user to process the file.
No verified public proof-of-concept code is available for this issue. See the Adobe Security Advisory APSB24-92 for vendor-provided technical detail.
Detection Methods for CVE-2024-49535
Indicators of Compromise
- XML or PDF files containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external entity references such as file:// or http:// URIs.
- Outbound network connections originating from Acrobat.exe or AcroRd32.exe to unexpected hosts shortly after a document is opened.
- Acrobat processes reading sensitive files (for example C:\Windows\win.ini, /etc/passwd) outside normal user workflow.
Detection Strategies
- Inspect inbound email attachments and downloaded files for XML payloads with external entity declarations using content disarm and reconstruction or static analysis.
- Correlate process telemetry to flag Acrobat or Reader spawning network activity or accessing system files immediately after opening a document.
- Apply EDR behavioral rules that identify document readers reading credential stores, configuration files, or other sensitive paths.
Monitoring Recommendations
- Log and alert on Acrobat versions in the environment that match the vulnerable build list, including 24.005.20307 and 24.001.30213.
- Monitor DNS and proxy logs for outbound requests initiated by Acrobat processes to non-Adobe domains.
- Track file open events for .xml, .xfdf, and .pdf files from untrusted sources and pair with subsequent process behavior.
How to Mitigate CVE-2024-49535
Immediate Actions Required
- Update Adobe Acrobat and Acrobat Reader to the fixed builds listed in APSB24-92 on all Windows and macOS endpoints.
- Inventory installed Acrobat versions and prioritize systems running 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, or 20.005.30710.
- Restrict opening of XML and PDF attachments from external or untrusted sources until patching is complete.
Patch Information
Adobe released fixed versions in security bulletin APSB24-92 on December 10, 2024. Administrators should deploy the updated Continuous and Classic track builds through Adobe Update Server, SCCM, Intune, or Jamf depending on platform.
Workarounds
- Enable Protected View and Protected Mode in Acrobat preferences to limit sandbox escapes from untrusted documents.
- Block inbound XML and XFDF attachments at the email gateway when feasible.
- Apply application control policies to prevent unpatched Acrobat versions from launching until updates are applied.
# Verify installed Acrobat Reader version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader" /s | findstr /i "Version"
# Verify on macOS
defaults read /Applications/Adobe\ Acrobat\ Reader.app/Contents/Info.plist CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
