Adobe Acrobat and Reader Use-After-Free Arbitrary Code Execution Vulnerability (CVE-2020-9715)

1. Apply Official Security Patches

Update Adobe Acrobat and Reader to the latest versions immediately as detailed in APSB20-48.

• In-App Update: Navigate to Help -> Check for Updates within the application.
• Manual Installation: Download the appropriate installers directly from the Adobe Security Bulletin APSB20-48.

2. Temporary Mitigations

• Enable Sandbox & Enhanced Security:

Go to Edit -> Preferences -> Security (Enhanced) and ensure Enable Protected Mode at startup and Enable Enhanced Security are checked to restrict payload execution capabilities.

• Email and Web Gateway Filtering:

Block or quarantine incoming PDF attachments from untrusted or external sources at the perimeter level.

This vulnerability is a Use-After-Free (UAF) flaw (CWE-416) existing within Adobe Acrobat and Reader.

The root cause lies in the improper management of object lifecycles during the parsing of specific PDF elements or streams. When an object is freed from memory, the application fails to clear the pointer referencing that memory location. An attacker can leverage heap manipulation techniques to populate the freed memory space with controlled malicious payloads, leading to arbitrary code execution when the dangling pointer is subsequently dereferenced.

Given its inclusion in the CISA KEV catalog and an extremely high EPSS score of 0.94, this vulnerability has been actively exploited in the wild. Successful exploitation compromises the integrity and confidentiality of the host system under the privileges of the executing user.