Product:
Acrobat Reader
Summary
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure, allowing an attacker to execute code in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-64899 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that triggers the out-of-bounds read when opened in Acrobat Reader. The attacker then needs to convince the victim to open this file, which would allow the attacker to execute arbitrary code in the context of the user running the application.
Affected Products
- Acrobat Reader 24.001.30264 – Affected by out-of-bounds read vulnerability.
- Acrobat Reader 20.005.30793 – Affected by out-of-bounds read vulnerability.
- Acrobat Reader 25.001.20982 – Affected by out-of-bounds read vulnerability.
- Acrobat Reader 24.001.30273 – Affected by out-of-bounds read vulnerability.
- Acrobat Reader 20.005.30803 – Affected by out-of-bounds read vulnerability.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure that they are using the latest version of Acrobat Reader. Adobe may provide patches or updates to address this issue, so users should regularly check for updates.