CVE-2025-47111 Overview
CVE-2025-47111 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. The flaw allows an attacker to crash the application by tricking a user into opening a malicious file. Affected versions include Acrobat Reader 24.001.30235, 20.005.30763, 25.001.20521, and earlier releases across both the Continuous and Classic tracks. Adobe published the fix in security bulletin APSB25-57. Exploitation requires local user interaction and results in denial-of-service impact only, with no confidentiality or integrity consequences.
Critical Impact
A crafted PDF opened by a victim triggers a NULL pointer dereference in Acrobat, terminating the process and disrupting document workflows.
Affected Products
- Adobe Acrobat DC and Acrobat Reader DC (Continuous track) 24.001.30235 and earlier
- Adobe Acrobat and Acrobat Reader (Classic track) 20.005.30763 and 25.001.20521 and earlier
- Windows and macOS installations of the above products
Discovery Timeline
- 2025-06-10 - CVE-2025-47111 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47111
Vulnerability Analysis
The vulnerability stems from Adobe Acrobat and Reader dereferencing a pointer without first validating that it references a valid object. When the application parses a specially crafted PDF, an internal routine reaches an execution path where an expected object structure is absent or uninitialized. The code then reads or writes through the NULL pointer, causing the operating system to raise an access violation and terminate the process.
Because the failure occurs during document parsing, the crash happens at file-open time. The attack requires no elevated privileges and no network access to the target. Impact is limited to availability, as reflected by the vector components indicating high availability impact but no confidentiality or integrity consequences. EPSS data lists the probability of observed exploitation at 0.335%.
Root Cause
The root cause is a missing NULL check [CWE-476] in a PDF object-handling routine within Acrobat's rendering or parsing pipeline. Malformed or missing structural elements in the PDF steer execution to a branch that assumes a valid object pointer. Adobe has not published low-level technical details beyond the advisory APSB25-57.
Attack Vector
An attacker crafts a malicious PDF containing manipulated objects or metadata that trigger the vulnerable code path. Delivery typically occurs through phishing email, malicious download links, or file-sharing platforms. The victim must open the file in a vulnerable version of Acrobat or Reader. On execution, the application crashes, disrupting any in-progress document review, signing, or form submission. The vulnerability does not permit code execution or data disclosure.
See the Adobe Acrobat Security Patch advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-47111
Indicators of Compromise
- Unexpected termination of Acrobat.exe or AcroRd32.exe shortly after a user opens a PDF from an email attachment or download.
- Windows Application event log entries with faulting module references tied to Adobe Acrobat or Reader binaries.
- macOS crash reports for Adobe Acrobat or Adobe Acrobat Reader referencing NULL address dereferences (EXC_BAD_ACCESS at address 0x0).
Detection Strategies
- Correlate PDF file arrival events (email gateway, browser download, USB) with subsequent Acrobat process crashes on the same host.
- Hunt for repeated Acrobat crash signatures across multiple endpoints that opened the same document hash, indicating a common malicious file.
- Inspect suspicious PDFs in a sandbox to observe whether opening the file consistently terminates Acrobat.
Monitoring Recommendations
- Ingest Windows Application and Reliability logs and macOS unified logs into your SIEM to alert on Acrobat process crashes.
- Track Acrobat and Reader version telemetry across the fleet to identify hosts still running versions listed in APSB25-57.
- Monitor email and web gateways for PDF attachments from untrusted senders, especially those flagged by content inspection engines.
How to Mitigate CVE-2025-47111
Immediate Actions Required
- Update Adobe Acrobat and Acrobat Reader to the fixed builds identified in Adobe security bulletin APSB25-57 on all Windows and macOS endpoints.
- Prioritize patching for users who regularly handle externally sourced PDFs, including legal, finance, and executive-support staff.
- Enable automatic updates for Acrobat and Reader so future security fixes deploy without manual intervention.
Patch Information
Adobe released fixed versions of Acrobat DC, Acrobat Reader DC, Acrobat 2020, and Acrobat Reader 2020 through security bulletin APSB25-57. Refer to the Adobe Acrobat Security Patch advisory for exact build numbers and download locations for each supported track and operating system.
Workarounds
- Enable Protected View for files originating from the internet and other untrusted locations to isolate parsing in a restricted sandbox.
- Block or quarantine PDF attachments from external senders at the email gateway until endpoints receive the patch.
- Instruct users to open unexpected PDFs in a browser-based viewer rather than the desktop Acrobat client where feasible.
# Configuration example: enforce Protected View for untrusted PDFs on Windows via registry
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bProtectedMode /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\DC\TrustManager" /v iProtectedView /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
