A critical security update for both Windows and macOS is available for Adobe Acrobat and Reader.
Per Adobe, this update fixes serious vulnerabilities that could lead to arbitrary code execution, application denial-of-service, and memory leaks.
Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks.
Affected versions:
- Acrobat DC – Continuous, versions 23.008.20470 and earlier
- Acrobat Reader DC – Continuous, versions 23.008.20470 and earlier
- Acrobat 2020 – Classic 2020, versions 20.005.30539 and earlier
- Acrobat Reader 2020 – Classic 2020, versions 20.005.30539 and earlier
13 Security Flaws Adobe Acrobat & Reader:
High-Severity Vulnerabilities (Critical):
- CVE-2024-20726, CVE-2024-20727, CVE-2024-20728, CVE-2024-20729, CVE-2024-20730, CVE-2024-20731
These vulnerabilities could allow attackers to execute arbitrary code on devices, potentially giving them complete control. Update immediately!
Moderate-Severity Vulnerabilities (Important):
- CVE-2024-20733, CVE-2024-20734, CVE-2024-20735, CVE-2024-20736, CVE-2024-20747, CVE-2024-20748, CVE-2024-20749
These vulnerabilities could cause memory leaks or application crashes, potentially impacting performance or stability. While not as critical as the others, updating is still recommended.
Adobe urges users to update their Acrobat and Reader software to address critical vulnerabilities.
Adobe extends its sincere gratitude to Cisco Talos (ciscotalos), Trend Micro Zero Day Initiative, and Kai Lu (k3vinlusec) for reporting vulnerabilities and protecting Adobe users (CVE-2024-20728-20749).