CVE-2025-27164: Adobe Acrobat Information Disclosure Flaw

CVE-2025-27164 Overview

CVE-2025-27164 is an out-of-bounds read vulnerability [CWE-125] affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Affected versions include Acrobat Reader 24.001.30225, 20.005.30748, 25.001.20428, and earlier releases. An attacker who convinces a user to open a crafted PDF can read memory outside the intended buffer, disclosing sensitive process data. The leaked data can be used to bypass mitigations such as Address Space Layout Randomization (ASLR), enabling more reliable follow-on exploitation. Adobe published a fix in security bulletin APSB25-14.

Critical Impact
Memory disclosure that enables ASLR bypass, weakening protections against chained code execution exploits targeting Acrobat users.

Affected Products

Adobe Acrobat and Acrobat DC (Classic and Continuous tracks) through 24.001.30225, 20.005.30748, 25.001.20428
Adobe Acrobat Reader and Acrobat Reader DC (Classic and Continuous tracks) through the same versions
Microsoft Windows and Apple macOS installations of the affected products

Discovery Timeline

2025-03-11 - CVE-2025-27164 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27164

Vulnerability Analysis

The flaw is an out-of-bounds read within Adobe Acrobat and Acrobat Reader's PDF parsing logic. When the application processes a malformed PDF object, it reads bytes past the end of an allocated buffer. The disclosed bytes originate from adjacent process memory, which can contain pointers, heap metadata, or object structures.

Exploitation requires user interaction. A victim must open a malicious PDF delivered through email, a web download, or a shared file location. The vulnerability does not directly grant code execution. Instead, it leaks memory addresses that defeat ASLR and support reliable exploitation of a separate memory-corruption bug.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a PDF structure. The parser trusts a length or offset field embedded in the file and reads that number of bytes without confirming they lie inside the source buffer. Adobe classifies the issue under CWE-125: Out-of-bounds Read.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a PDF containing a manipulated object that triggers the boundary error when opened in a vulnerable Acrobat build. The leaked memory contents can be exfiltrated through JavaScript embedded in the PDF or observed through side effects during rendering. Technical details are documented in the Talos Vulnerability Report TALOS-2025-2136.

No public proof-of-concept exploit is currently listed for this CVE, and it is not on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-27164

Indicators of Compromise

PDF files containing malformed or oversized object length fields that trigger parser errors
Adobe Acrobat or Acrobat Reader processes crashing or exhibiting abnormal memory access patterns after opening an untrusted document
Outbound network connections initiated by AcroRd32.exe or Acrobat.exe immediately after a PDF is opened

Detection Strategies

Inventory Acrobat and Acrobat Reader installations and flag hosts running versions at or below 24.001.30225, 20.005.30748, and 25.001.20428
Inspect inbound PDFs at email and web proxies using static analysis tools that identify malformed object streams and suspicious embedded JavaScript
Correlate PDF-open events with subsequent child process creation or network activity from Acrobat binaries

Monitoring Recommendations

Alert on AcroRd32.exe or Acrobat.exe spawning shells, scripting engines, or LOLBins such as powershell.exe, wscript.exe, or cmd.exe
Monitor endpoint telemetry for Acrobat process crashes correlated with PDF file access, which can indicate exploitation attempts
Track user reports of unexpected Acrobat behavior after opening documents from external senders

How to Mitigate CVE-2025-27164

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions listed in security bulletin APSB25-14 on all Windows and macOS endpoints
Prioritize patching for users who routinely open PDFs from external sources, such as legal, finance, and executive teams
Block or quarantine PDF attachments from untrusted senders at the email gateway pending remediation

Patch Information

Adobe released fixed builds documented in the Adobe Acrobat Security Advisory APSB25-14. Administrators should deploy the updated Acrobat and Acrobat Reader versions to remediate CVE-2025-27164 and other issues addressed in the same bulletin.

Workarounds

Enable Protected View or Protected Mode in Acrobat so untrusted PDFs render in a restricted sandbox
Disable JavaScript execution in Acrobat and Acrobat Reader to reduce the ability of a malicious PDF to exfiltrate leaked memory
Route PDF handling for high-risk users through a browser-based or server-side rendering solution until patched clients are deployed

bash

# Example: disable Acrobat JavaScript via Windows registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f