CVE-2025-27161: Adobe Acrobat RCE Vulnerability

CVE-2025-27161 Overview

CVE-2025-27161 is an out-of-bounds read vulnerability [CWE-125] affecting Adobe Acrobat and Acrobat Reader. Affected versions include Acrobat Reader 24.001.30225, 20.005.30748, 25.001.20428, and earlier releases on Windows and macOS. The flaw occurs when the application parses a crafted file, causing a read past the end of an allocated memory structure. An attacker can leverage the condition to execute code in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Critical Impact
Successful exploitation enables arbitrary code execution in the context of the logged-in user, potentially exposing sensitive document content and enabling further compromise of the host.

Affected Products

Adobe Acrobat (Classic track) versions 24.001.30225 and earlier
Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 25.001.20428 and earlier
Adobe Acrobat and Acrobat Reader (Classic 2020 track) versions 20.005.30748 and earlier on Windows and macOS

Discovery Timeline

2025-03-11 - CVE-2025-27161 published to NVD
2025-04-28 - Last updated in NVD database

Technical Details for CVE-2025-27161

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered during file parsing in Adobe Acrobat and Acrobat Reader. When the parser processes a malformed structure inside a crafted document, it reads memory beyond the boundary of an allocated buffer. The disclosed memory may include adjacent heap metadata, object pointers, or function pointers that an attacker can use to craft a reliable exploitation primitive.

The condition can be combined with other memory corruption primitives to achieve arbitrary code execution within the current user's security context. Because Acrobat Reader runs with the privileges of the interactive user, a successful exploit gives the attacker the same level of access. The vulnerability does not bypass authentication and does not require elevated privileges to trigger.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of attacker-controlled data structures inside a PDF or related document format. The parser trusts a length, offset, or index supplied by the file without validating it against the allocated buffer size. Adobe has not published low-level technical details. Refer to the Adobe Security Advisory APSB25-14 for vendor-provided information.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted file through email, a web download, a messaging platform, or a shared file location. The victim must open the file in a vulnerable version of Acrobat or Acrobat Reader. No network exposure of the application is required, and no authentication on the target system is needed beyond the victim's own session.

No public proof-of-concept exploit code is currently associated with this CVE, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-27161

Indicators of Compromise

Acrobat or Acrobat Reader process (Acrobat.exe, AcroRd32.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe shortly after opening a document
Unexpected crashes of Acrobat or Acrobat Reader correlated with the opening of documents from external sources
PDF files arriving from untrusted senders that contain unusually large, malformed, or obfuscated object streams

Detection Strategies

Inventory endpoints running Acrobat and Acrobat Reader versions at or below 24.001.30225, 20.005.30748, and 25.001.20428 and flag them as unpatched
Monitor process lineage where Acrobat is the parent of a scripting interpreter, shell, or LOLBin
Inspect email gateway and proxy logs for PDF attachments from external senders followed by anomalous endpoint behavior

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging to capture post-exploitation activity launched from Acrobat
Forward endpoint process, file, and network telemetry to a central data lake to correlate document opens with suspicious child activity
Track Adobe Reader crash events from the Windows Application event log and the macOS Unified Log for repeated parser failures

How to Mitigate CVE-2025-27161

Immediate Actions Required

Apply Adobe's March 2025 security updates referenced in Adobe Security Advisory APSB25-14 to all Windows and macOS endpoints
Prioritize patching on workstations used by high-risk users such as executives, finance staff, and personnel who routinely open external PDFs
Block or quarantine PDF attachments from untrusted external senders at the email gateway until patching is complete

Patch Information

Adobe addressed CVE-2025-27161 in the updates documented in Adobe Security Advisory APSB25-14. Update Acrobat and Acrobat Reader to versions later than 24.001.30225 (Classic), 20.005.30748 (Classic 2020), and 25.001.20428 (Continuous) on both Windows and macOS.

Workarounds

Enable Protected View and Protected Mode in Acrobat and Acrobat Reader to constrain the parser within a sandbox
Configure Acrobat to disable JavaScript execution in PDFs for users who do not require it
Restrict PDF handlers so that documents from internet-zone sources open in a hardened viewer or browser-based preview until patches are deployed

bash

# Configuration example: disable JavaScript in Acrobat Reader on Windows via registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files originating from the internet
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f