CVE-2025-27159: Adobe Acrobat RCE Vulnerability

CVE-2025-27159 Overview

CVE-2025-27159 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428, and earlier releases on Windows and macOS. Successful exploitation allows arbitrary code execution in the context of the current user. Attackers must convince a victim to open a malicious PDF file, which makes phishing and social engineering the primary delivery vectors. Adobe published security advisory APSB25-14 to address the issue.

Critical Impact
Opening a crafted PDF can trigger arbitrary code execution with the privileges of the logged-in user, enabling malware installation, credential theft, or follow-on lateral movement.

Affected Products

Adobe Acrobat (Classic track) versions 24.001.30225 and earlier
Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 25.001.20428 and earlier
Adobe Acrobat and Reader version 20.005.30748 and earlier on Microsoft Windows and Apple macOS

Discovery Timeline

2025-03-11 - CVE-2025-27159 published to NVD
2025-03-11 - Adobe releases security advisory APSB25-14 with patched versions
2025-04-28 - Last updated in NVD database

Technical Details for CVE-2025-27159

Vulnerability Analysis

The vulnerability is a Use After Free condition [CWE-416] within Adobe Acrobat and Acrobat Reader. Use After Free occurs when a program continues to reference memory after it has been freed. An attacker who controls the contents of the freed allocation can manipulate program flow when the dangling pointer is dereferenced. In Acrobat Reader, this typically involves embedded JavaScript, malformed object streams, or crafted form fields inside a PDF that trigger premature object destruction while a reference remains active.

The attack requires local user interaction, specifically opening a malicious PDF document. There is no network-based remote trigger, but malicious PDFs are commonly distributed through email attachments, drive-by downloads, and shared file repositories. Impact across confidentiality, integrity, and availability is high because code executes with the user's privileges.

Root Cause

The root cause is improper object lifetime management within Acrobat's PDF parsing or scripting engine. A pointer continues to reference an object after the underlying memory has been deallocated. When that pointer is dereferenced, the attacker-controlled replacement memory is treated as a valid object, enabling control of the instruction pointer or critical data structures.

Attack Vector

An attacker crafts a malicious PDF document and delivers it through phishing, malicious websites, or compromised file shares. When the victim opens the file in a vulnerable version of Acrobat or Reader, the parser triggers the Use After Free condition. The attacker then leverages heap grooming to place controlled data in the freed region and gains arbitrary code execution as the current user. No elevated privileges are required to launch the attack, and no authentication is needed against the target system.

No public proof-of-concept exploit has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Adobe Acrobat Security Advisory APSB25-14 for vendor technical context.

Detection Methods for CVE-2025-27159

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe, AcroRd32.exe, or AdobeAcrobat on macOS, particularly cmd.exe, powershell.exe, wscript.exe, or shell interpreters
PDF files arriving from untrusted senders containing embedded JavaScript, form actions, or unusual object streams
Outbound network connections initiated by Acrobat processes to unknown external hosts shortly after PDF rendering
New files written by Acrobat to user-writable locations such as %APPDATA%, %TEMP%, or ~/Library/Application Support

Detection Strategies

Monitor process lineage where Acrobat or Reader is the parent of scripting or shell interpreters, which is a strong indicator of post-exploitation
Inspect PDF attachments using static analysis tools to flag suspicious JavaScript objects, malformed cross-reference tables, and abnormal object reuse patterns
Correlate endpoint detection telemetry with email gateway logs to identify PDFs delivered to multiple recipients within a short window

Monitoring Recommendations

Enable command-line and process creation auditing on Windows endpoints, including Sysmon Event ID 1, to capture Acrobat child processes
Track Acrobat version inventory across the fleet to identify unpatched hosts running versions at or below 24.001.30225, 20.005.30748, or 25.001.20428
Alert on Acrobat processes that load unusual DLLs or perform memory allocations consistent with shellcode staging

How to Mitigate CVE-2025-27159

Immediate Actions Required

Apply the Adobe security updates referenced in advisory APSB25-14 to all Acrobat and Acrobat Reader installations across Windows and macOS
Block inbound PDF attachments from external senders at the email gateway until patching is complete, or detonate them in a sandbox first
Communicate to users that they must not open PDF attachments from unverified senders during the patch rollout window

Patch Information

Adobe addressed CVE-2025-27159 in updated builds released alongside APSB25-14. Administrators should upgrade Acrobat and Reader to versions later than 24.001.30225 (Classic 2024), 20.005.30748 (Classic 2020), and 25.001.20428 (Continuous). Both Windows and macOS installations require the update. Verify deployment using Acrobat's Help > About menu or via software inventory tooling.

Workarounds

Disable JavaScript in Acrobat and Reader via Preferences > JavaScript to reduce the attack surface available to malicious PDFs
Enable Protected View and Protected Mode for all files originating from potentially unsafe locations
Use Group Policy or Jamf configuration profiles to enforce restricted PDF handling and block standalone Acrobat execution from email clients

bash

# Windows registry example: disable Acrobat JavaScript via Group Policy
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Enforce Protected View for all files
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f