CVE-2025-43579: Adobe Acrobat DC Information Disclosure Flaw

CVE-2025-43579 Overview

CVE-2025-43579 is an Information Exposure vulnerability affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. The flaw allows an attacker to bypass a security feature and gain unauthorized access to sensitive information. Affected versions include Acrobat Reader 24.001.30235, 20.005.30763, 25.001.20521, and earlier releases across the Continuous and Classic tracks. Adobe published fixes in advisory APSB25-57. The weakness maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
An attacker can bypass an Acrobat security control to read sensitive information from the local user context when a crafted document is opened.

Affected Products

Adobe Acrobat DC and Acrobat Reader DC (Continuous track), versions 24.001.30235 and earlier
Adobe Acrobat and Acrobat Reader (Classic track), versions 20.005.30763 and 25.001.20521 and earlier
Microsoft Windows and Apple macOS installations of the affected Acrobat products

Discovery Timeline

2025-06-10 - CVE-2025-43579 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43579

Vulnerability Analysis

The vulnerability is an Information Exposure issue [CWE-200] in Adobe Acrobat and Acrobat Reader. Processing a crafted PDF causes the application to disclose sensitive information that a built-in security feature should have protected. Adobe classifies the outcome as a security feature bypass with a confidentiality impact but no integrity or availability impact. Exploitation requires the victim to open a malicious file locally, but no additional user interaction beyond that is needed once the document is loaded. The issue affects both the Continuous and Classic release tracks on Windows and macOS.

Root Cause

Adobe attributes the flaw to improper handling of data that should remain restricted inside the Acrobat sandboxed rendering pipeline. A guard intended to prevent disclosure of sensitive content is bypassed during document processing, exposing data that the security feature is designed to isolate. Adobe has not published low-level technical details beyond the APSB25-57 advisory.

Attack Vector

The attack vector is local. An attacker delivers a crafted PDF to a target through email, file share, web download, or a compromised web page rendered in a browser plugin. When the victim opens the document in a vulnerable Acrobat or Acrobat Reader build, the malicious content triggers the bypass and extracts sensitive information from the local context. No authentication is required on the target system, and no exploit is publicly available at the time of publication.

See the Adobe Acrobat Security Advisory (APSB25-57) for vendor-authored technical context.

Detection Methods for CVE-2025-43579

Indicators of Compromise

Adobe Acrobat or Acrobat Reader processes (Acrobat.exe, AcroRd32.exe, AdobeAcrobat on macOS) opening PDFs from untrusted email attachments, temporary internet directories, or removable media.
PDFs containing unusual embedded JavaScript, form actions, or external resource references arriving from unverified senders.
Acrobat processes performing unexpected network callbacks or reading files outside the user's typical document paths.

Detection Strategies

Inventory installed Acrobat and Acrobat Reader builds and flag any version at or below 24.001.30235, 20.005.30763, or 25.001.20521.
Correlate PDF open events with subsequent file read or network activity by the Acrobat process to identify anomalous information access.
Use EDR telemetry to identify child processes spawned by Acrobat or Reader immediately after document open, which can indicate exploitation chains.

Monitoring Recommendations

Alert on Acrobat and Reader processes reading sensitive locations such as user profile directories, credential stores, or browser data folders.
Monitor mail and web gateways for PDFs matching threat intelligence indicators tied to Adobe advisory APSB25-57.
Track patch compliance for Acrobat and Reader across Windows and macOS endpoints and escalate hosts that remain on vulnerable versions.

How to Mitigate CVE-2025-43579

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB25-57 to all Acrobat and Acrobat Reader installations on Windows and macOS.
Prioritize patching endpoints that regularly handle PDFs from external senders, such as finance, legal, and executive systems.
Restrict opening of PDFs from untrusted sources until patches are deployed enterprise-wide.

Patch Information

Adobe released fixed builds through advisory APSB25-57. Upgrade Continuous track installations above 24.001.30235 and Classic track installations above 20.005.30763 and 25.001.20521. Full version details and download links are available in the Adobe Acrobat Security Advisory.

Workarounds

Enable Protected View for all files originating from potentially unsafe locations to constrain Acrobat's access to sensitive resources.
Disable JavaScript in Acrobat and Reader through enterprise policy for user populations that do not require it.
Block inbound PDFs at the email gateway from unauthenticated or low-reputation senders during the patch window.

bash

# Windows registry example: enable Protected View for all files in Adobe Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f

# Disable JavaScript in Acrobat Reader DC
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f