CVE-2025-43575: Adobe Acrobat DC RCE Vulnerability

CVE-2025-43575 Overview

CVE-2025-43575 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Acrobat and Acrobat Reader. The flaw impacts Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521, and earlier on Windows and macOS. An attacker who crafts a malicious PDF can trigger memory corruption that leads to arbitrary code execution in the context of the current user. Exploitation requires user interaction, since the victim must open the malicious file. Adobe addressed the issue in security bulletin APSB25-57.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the user opening a malicious PDF document, enabling local code execution on Windows and macOS endpoints.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track) versions 24.001.30235 and earlier
Adobe Acrobat and Acrobat Reader (Classic track) versions 20.005.30763 and 25.001.20521 and earlier
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2025-06-10 - CVE-2025-43575 published to the National Vulnerability Database
2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-43575

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition classified under [CWE-787]. Acrobat writes data beyond the bounds of an allocated buffer while parsing crafted content within a PDF document. The corruption occurs in the renderer process running with the privileges of the user who opens the file.

An attacker can shape the malformed structures inside the PDF to overwrite adjacent memory, including function pointers or object metadata. This primitive enables control flow hijacking and arbitrary code execution. Because Acrobat handles complex parsing of fonts, images, embedded scripts, and XFA forms, the attack surface for memory corruption is broad.

The attack vector is local and requires user interaction. A target must download and open a malicious PDF, typically delivered through phishing email, instant messaging, or a watering-hole site. No elevated privileges are needed for the attacker to stage the payload.

Root Cause

The root cause is improper validation of size or index values when writing to a memory buffer during PDF parsing. When an attacker-controlled field exceeds expected bounds, Acrobat performs a write that crosses the allocated region. Adobe has not publicly disclosed the specific parser component affected. Refer to the Adobe Acrobat Security Advisory APSB25-57 for vendor details.

Attack Vector

An attacker constructs a PDF containing malformed objects that trigger the out-of-bounds write during rendering. The file is delivered to the victim through email attachments, malicious websites, or shared document repositories. When the victim opens the file in a vulnerable Acrobat or Reader version, the corruption executes attacker-supplied shellcode. Code runs with the same permissions as the user, enabling persistence, credential theft, or lateral movement.

No verified public proof-of-concept code is available at the time of writing. See the Adobe Acrobat Security Advisory for the authoritative technical reference.

Detection Methods for CVE-2025-43575

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe, powershell.exe, or shell utilities on macOS
Acrobat process crashes with access violation exceptions correlated with the opening of PDF attachments
Outbound network connections initiated by Acrobat processes to unfamiliar domains shortly after a PDF is opened

Detection Strategies

Hunt for process trees where Acrobat is the parent of script interpreters, LOLBins, or unsigned binaries
Inspect PDF attachments delivered via email for malformed object streams, suspicious JavaScript, or anomalous embedded fonts
Correlate endpoint crash telemetry from Acrobat with subsequent process creation or file write activity in user profile directories

Monitoring Recommendations

Enable command-line and process creation logging on endpoints running Acrobat to capture post-exploitation behavior
Monitor file integrity and persistence locations such as Run keys, scheduled tasks, and LaunchAgents after Acrobat usage
Forward Acrobat application crash events and EDR telemetry to a centralized analytics platform for correlation across users

How to Mitigate CVE-2025-43575

Immediate Actions Required

Apply the Adobe security update referenced in APSB25-57 to all Acrobat and Reader installations on Windows and macOS
Inventory endpoints running the affected versions and prioritize patching for users who routinely process external PDFs
Block or quarantine inbound PDF attachments from untrusted senders at the email gateway until patching is complete

Patch Information

Adobe has released fixed versions for both Continuous and Classic tracks of Acrobat and Acrobat Reader. Administrators should consult the Adobe Acrobat Security Advisory APSB25-57 for the exact patched build numbers and deploy through the Adobe Admin Console, enterprise software distribution tooling, or Acrobat's built-in updater.

Workarounds

Enable Acrobat's Protected View and Protected Mode to constrain renderer process privileges when opening untrusted PDFs
Restrict execution of JavaScript inside Acrobat through enterprise policy when not required by business workflows
Use application allowlisting to prevent Acrobat from spawning interpreters or unsigned executables

bash

# Disable JavaScript in Acrobat via Windows registry (enterprise workaround)
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

# Enforce Protected View for files from untrusted sources
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f