CVE-2025-54255: Adobe Acrobat Auth Bypass Vulnerability

CVE-2025-54255 Overview

Adobe Acrobat and Acrobat Reader contain a Violation of Secure Design Principles vulnerability [CWE-657] that enables a security feature bypass affecting integrity. The flaw impacts Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672, and earlier releases on Windows and macOS. Exploitation requires local access but no authentication and no user interaction. Adobe addressed the issue in security advisory APSB25-85.

Critical Impact
An unauthenticated local attacker can bypass a security control in Adobe Acrobat Reader to compromise the integrity of the application without any user interaction.

Affected Products

Adobe Acrobat DC (Continuous track) and Acrobat (Classic track) up to 24.001.30254 / 25.001.20672
Adobe Acrobat Reader DC and Acrobat Reader (Classic) up to 20.005.30774
Windows and macOS installations of the affected Acrobat family

Discovery Timeline

2025-09-09 - CVE-2025-54255 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54255

Vulnerability Analysis

The vulnerability is classified under [CWE-657] Violation of Secure Design Principles. Adobe describes the outcome as a security feature bypass with an integrity impact. An attacker leveraging the flaw can undermine a built-in protection mechanism inside Acrobat Reader without needing valid credentials or tricking a user into performing an action. Because scope is unchanged, the attacker operates within the trust boundary of the Acrobat process itself.

The issue does not directly grant code execution or data disclosure. It weakens an internal safeguard that other Acrobat mitigations rely upon. When chained with a separate flaw, the bypass can allow follow-on tampering that a hardened configuration would otherwise block.

Root Cause

Adobe attributes the defect to a design-level violation rather than a memory safety error. A security control was implemented in a way that does not fully enforce its intended trust boundary. Attackers with local access to the target system can interact with the affected component and reach a state the designers did not anticipate.

Attack Vector

The attack vector is local. An attacker must be able to run code or place content on the target machine, for example through an existing low-privilege foothold or a malicious file dropped in a location Acrobat processes. Once triggered, the bypass proceeds without further prompts or user interaction. Full technical mechanics have not been publicly detailed. See the Adobe Security Advisory APSB25-85 for vendor guidance.

Detection Methods for CVE-2025-54255

Indicators of Compromise

Acrobat or Reader processes (Acrobat.exe, AcroRd32.exe) spawning unexpected child processes or writing to unusual paths
Modifications to Acrobat configuration files, plug-in directories, or JavaScript trust settings outside of installer activity
Presence of unsigned or untrusted DLLs loaded by Acrobat processes

Detection Strategies

Inventory Acrobat and Reader installations and flag any host running versions at or below 24.001.30254, 20.005.30774, or 25.001.20672
Enable file integrity monitoring on Acrobat program directories and per-user configuration stores
Correlate Acrobat process telemetry with local privilege changes or persistence artifacts on the same host

Monitoring Recommendations

Collect endpoint process, module load, and file write events for Acrobat binaries into your SIEM or data lake
Alert on Acrobat processes disabling Protected Mode, Protected View, or sandbox-related registry values
Track patch compliance for APSB25-85 across the Windows and macOS fleet on a recurring schedule

How to Mitigate CVE-2025-54255

Immediate Actions Required

Apply the Adobe updates referenced in APSB25-85 to all Acrobat and Reader installations on Windows and macOS
Prioritize systems where users open PDFs from external or untrusted sources
Confirm that Protected Mode (Windows) and the sandbox (macOS) remain enabled after patching

Patch Information

Adobe released fixed builds through security advisory APSB25-85. Upgrade Acrobat DC and Acrobat Reader DC (Continuous) and the Classic 2020 and Classic 2024 tracks to the versions listed in the advisory. Enterprise deployments should use the Adobe Admin Console, SCCM, Intune, or Jamf to push the updated MSI or PKG installers.

Workarounds

Restrict local access on shared or multi-user systems to reduce exposure to the local attack vector
Enforce application allowlisting so only signed Adobe binaries and approved plug-ins can load inside Acrobat
Disable Acrobat JavaScript and block execution of non-PDF attachments through Acrobat trust settings until patches are applied

bash

# Verify installed Acrobat Reader version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer" /v Version

# Verify installed Acrobat version on macOS
defaults read "/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Info.plist" CFBundleShortVersionString