Adobe Acrobat Use-After-Free Vulnerability

Who is affected

How to fix it

Treat CVE-2020-9715 as an actively exploited Adobe Acrobat and Reader use-after-free vulnerability that can lead to arbitrary code execution when a malicious PDF is opened. Adobe APSB20-48 lists affected Acrobat and Reader DC, 2020, 2017, and 2015 tracks and recommends updating to the fixed releases or later. Prioritize users and systems that handle external PDFs, email attachments, browser downloads, support tickets, or shared document repositories. If an affected product track is no longer supported in your environment, replace it with a currently supported Adobe release instead of leaving the old branch installed.

1. Inventory Adobe Acrobat DC, Acrobat Reader DC, Acrobat 2020, Reader 2020, Acrobat 2017, Reader 2017, Acrobat 2015, and Reader 2015 across Windows and macOS endpoints.
2. Identify Acrobat DC and Reader DC 2020.009.20074 and earlier, Acrobat/Reader 2020 version 2020.001.30002, Acrobat/Reader 2017 version 2017.011.30171 and earlier, and Acrobat/Reader 2015 version 2015.006.30523 and earlier as affected.
3. Update Acrobat DC and Reader DC to 2020.012.20041 or later.
4. Update Acrobat/Reader 2020 to 2020.001.30005 or later, Acrobat/Reader 2017 to 2017.011.30175 or later, and Acrobat/Reader 2015 to 2015.006.30527 or later where those tracks are still supported.
5. Use Help > Check for Updates, automatic updates, Adobe enterprise installers, SCCM, GPO, Intune, MDM, Apple Remote Desktop, SSH, or another approved deployment workflow.
6. Apply temporary controls for PDF handling until patching is complete, including warnings for unexpected attachments and tighter filtering on externally supplied PDFs.
7. Review endpoint telemetry for suspicious Acrobat child processes, unusual PDF launches, dropped files, or alerts connected to malicious documents.
8. Remove or replace unsupported Acrobat and Reader installations that cannot receive vendor security updates.

Verify the fix

• Confirm Acrobat DC and Reader DC installations report version 2020.012.20041 or later.
• Confirm Acrobat/Reader 2020 reports 2020.001.30005 or later, Acrobat/Reader 2017 reports 2017.011.30175 or later, and Acrobat/Reader 2015 reports 2015.006.30527 or later where those tracks remain in use.
• Confirm endpoint inventory, MDM, SCCM, or software management data no longer shows affected versions.
• Run Help > Check for Updates on a sample of managed endpoints and confirm no related Acrobat or Reader security update remains pending.
• Review EDR and mail-security logs after remediation for additional malicious PDF activity.
• Run a Fixnx scan against public download, upload, and support surfaces to understand related PDF exposure paths.

Related categories

Trusted references

FAQ