CVE-2025-43550: Adobe Acrobat DC RCE Vulnerability

CVE-2025-43550 Overview

CVE-2025-43550 is a Use After Free vulnerability [CWE-416] in Adobe Acrobat and Acrobat Reader. The flaw affects Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521, and earlier across Windows and macOS. An attacker who successfully exploits this issue can achieve arbitrary code execution in the context of the current user.

Exploitation requires user interaction. A victim must open a malicious PDF file crafted by the attacker. The vulnerability impacts both the Continuous and Classic release tracks of Adobe Acrobat DC and Acrobat Reader DC.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the current user, enabling malware installation, credential theft, and further lateral movement from a single malicious document.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) — versions 24.001.30235 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) — versions 20.005.30763 and 25.001.20521 and earlier
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2025-06-10 - CVE-2025-43550 published to NVD
2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-43550

Vulnerability Analysis

The vulnerability is a Use After Free condition within the PDF parsing and rendering components of Adobe Acrobat. A Use After Free occurs when a program continues to reference memory after it has been freed, allowing an attacker to influence the contents of that freed memory region.

When Acrobat processes a maliciously crafted PDF, the parser frees an internal object but retains a dangling reference. Subsequent operations dereference the stale pointer. Attackers can spray the heap with controlled data to occupy the reclaimed allocation, redirecting execution flow when the application reuses the freed object.

The issue is rated for local attack vector because the malicious file must be delivered and opened on the target system. However, delivery is trivial through email attachments, drive-by downloads, or shared document workflows.

Root Cause

The root cause is improper object lifetime management within Acrobat's document object handling code. The application releases an object while other code paths still hold and operate on references to it. This violates the contract between memory allocation and object reference counting.

Attack Vector

An attacker constructs a PDF document containing crafted objects, streams, or scripts that trigger the vulnerable code path. The attacker delivers the file through phishing, web download, or file sharing. When the user opens the document in Acrobat or Acrobat Reader, the parser frees an object and later reuses the dangling pointer, transferring execution to attacker-controlled data.

No authentication or elevated privileges are required on the target. Code execution occurs in the security context of the user running Acrobat. The vulnerability mechanics are described in the Adobe Acrobat Security Advisory APSB25-57.

Detection Methods for CVE-2025-43550

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Crash dumps or Windows Error Reporting events naming Acrobat modules following the opening of a PDF
PDF files containing unusual JavaScript, embedded objects, or malformed cross-reference tables delivered via email or web download
Outbound network connections initiated by Acrobat processes to untrusted hosts shortly after document open

Detection Strategies

Monitor for process lineage anomalies where Acrobat spawns interpreters, shells, or LOLBins
Inspect inbound PDFs at the email gateway for embedded JavaScript, action triggers, and structural anomalies
Alert on memory access violations in Acrobat processes captured by exploit protection telemetry
Correlate PDF open events with subsequent file writes to user-writable directories such as %APPDATA% and %TEMP%

Monitoring Recommendations

Enable detailed process creation logging (Windows Event ID 4688 with command line) and macOS Endpoint Security framework events
Track installed Acrobat versions across the fleet to identify hosts still running vulnerable builds below 24.001.30235, 20.005.30763, or 25.001.20521
Forward endpoint telemetry to a centralized data lake for retrospective hunting against newly published indicators

How to Mitigate CVE-2025-43550

Immediate Actions Required

Update Adobe Acrobat and Acrobat Reader to the fixed versions published in Adobe Security Bulletin APSB25-57
Inventory all Windows and macOS endpoints to confirm no vulnerable Continuous or Classic track builds remain
Block or quarantine inbound PDFs from untrusted senders at the mail gateway until patching is complete
Brief users on the phishing risk and reinforce that opening unexpected PDF attachments is the trigger for exploitation

Patch Information

Adobe addressed CVE-2025-43550 in the security update referenced in APSB25-57. Administrators should deploy updated builds above the affected versions through Adobe Update Server, SCCM, Intune, Jamf, or the built-in Acrobat updater. Verify successful installation by checking the Help > About Adobe Acrobat dialog or by querying installed software inventory.

Workarounds

Enable Acrobat Protected View for files from untrusted sources to constrain process privileges and file system access
Disable JavaScript execution in Acrobat through Preferences > JavaScript to reduce the attack surface for malicious PDFs
Apply application allowlisting to prevent Acrobat from launching child processes such as scripting interpreters and shells
Restrict end-user permissions so that code execution under the user context cannot escalate to administrative actions

bash

# Disable JavaScript in Adobe Acrobat via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for all files
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f