Product:
Acrobat Reader
Summary
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited unauthorized write access. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.3 | CVE-2025-64786 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious file that bypasses the cryptographic signature verification process in Acrobat Reader. By executing this file on a vulnerable version of the software, the attacker can gain unauthorized write access without needing any user interaction, making it a low-complexity attack.
Affected Products
- Acrobat Reader version 24.001.30264: Affected by improper cryptographic signature verification.
- Acrobat Reader version 20.005.30793: Vulnerable to security feature bypass.
- Acrobat Reader version 25.001.20982: Exposed to unauthorized write access risks.
- Acrobat Reader version 24.001.30273: Susceptible to exploitation without user interaction.
- Acrobat Reader version 20.005.30803: Can be exploited through crafted malicious files.
Mitigation
To mitigate this vulnerability, users should update their Acrobat Reader to the latest version provided by Adobe. Regularly applying security updates and patches will help protect against potential exploits and ensure the integrity of the software.