CVE-2025-43574: Adobe Acrobat DC RCE Vulnerability

CVE-2025-43574 Overview

CVE-2025-43574 is a Use After Free vulnerability [CWE-416] affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Adobe Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521, and earlier are affected. Successful exploitation allows arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious PDF file. Adobe published the fix in security bulletin APSB25-57.

Critical Impact
Attackers can execute arbitrary code with the privileges of the user who opens a crafted PDF, enabling local code execution, credential theft, or follow-on payload delivery.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 24.001.30235 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30763 and 25.001.20521 and earlier
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2025-06-10 - CVE-2025-43574 published to NVD
2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-43574

Vulnerability Analysis

The vulnerability is a Use After Free condition in the Adobe Acrobat and Acrobat Reader PDF processing code. A Use After Free flaw occurs when a program continues to reference memory after that memory has been released back to the allocator. An attacker who controls the contents of the reallocated region can overwrite function pointers or object metadata. When the dangling reference is later dereferenced, the attacker gains control over program execution. Adobe classifies the impact as arbitrary code execution in the context of the current user, meaning the attacker inherits the rights of the account opening the file. The issue affects both the Continuous and Classic update tracks across Windows and macOS.

Root Cause

The root cause is improper object lifetime management within Acrobat's PDF parsing or rendering subsystem [CWE-416]. A reference to a freed object remains reachable and is later dereferenced. Adobe has not published low-level technical details in APSB25-57 beyond the vulnerability class and affected versions.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious PDF containing structures that trigger the use-after-free condition. The victim must open the file in a vulnerable Acrobat or Reader build. Common delivery methods include phishing email attachments, drive-by downloads, and shared document repositories. No authentication is required, and no special privileges are needed by the attacker.

No public proof-of-concept exploit code is referenced in the enriched data. For technical particulars, refer to the Adobe Security Bulletin APSB25-57.

Detection Methods for CVE-2025-43574

Indicators of Compromise

Acrobat or Reader processes (Acrobat.exe, AcroRd32.exe, AdobeAcrobat) spawning unexpected child processes such as cmd.exe, powershell.exe, or bash
PDF files arriving from untrusted sources that trigger renderer crashes or repeated Acrobat restart events
Unexpected network connections initiated by an Acrobat process shortly after a PDF is opened
Writes to autorun locations, scheduled tasks, or LaunchAgents by an Acrobat child process

Detection Strategies

Hunt for parent-child process relationships where Acrobat or Reader spawns scripting interpreters or shell binaries
Alert on application crashes in Acrobat.exe or AcroRd32.exe correlated with PDF file opens, which can indicate exploitation attempts
Inspect email gateways and web proxies for PDF attachments containing malformed object streams or unusual JavaScript constructs

Monitoring Recommendations

Track installed Acrobat and Reader versions across the fleet and flag hosts running builds at or below 24.001.30235, 20.005.30763, or 25.001.20521
Monitor endpoint telemetry for memory access violations in Acrobat processes
Correlate user mailbox delivery events with subsequent Acrobat process anomalies on the recipient host

How to Mitigate CVE-2025-43574

Immediate Actions Required

Apply the updates referenced in Adobe Security Bulletin APSB25-57 to all Windows and macOS endpoints
Inventory all Acrobat and Reader installations and prioritize patching internet-facing and high-privilege user workstations
Block or quarantine PDF attachments from untrusted external senders at the email gateway until patching completes
Educate users to avoid opening unsolicited PDF files, since exploitation requires user interaction

Patch Information

Adobe released fixed builds in APSB25-57. Administrators should upgrade Acrobat DC and Acrobat Reader DC (Continuous) past 24.001.30235, and Acrobat and Acrobat Reader (Classic) past 20.005.30763 and 25.001.20521. Refer to the Adobe Security Bulletin APSB25-57 for exact fixed version numbers and download locations.

Workarounds

Enable Acrobat Protected View and Protected Mode (sandbox) to limit the impact of a successful exploit
Disable JavaScript execution in Acrobat and Reader through Preferences > JavaScript where business workflows allow
Configure file-association policies so PDFs from untrusted zones open in a hardened viewer or browser sandbox
Restrict standard users from running with administrative rights, reducing the impact of code execution under the user context

bash

# Configuration example: disable Acrobat JavaScript via Windows registry (per-user)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Adobe Acrobat\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Verify installed Acrobat Reader version on Windows
wmic datafile where name="C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe" get Version