CVE-2020-24435: Adobe Acrobat Reader heap buffer overflow in submitForm

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.8 with high EPSS and potential for code execution via a common file type, though no confirmed in-the-wild exploitation or KEV listing.

What it is

Adobe Acrobat Reader DC (and Acrobat) versions 2020.012.20048, 2020.001.30005, and 2017.011.30175 and earlier contain a heap-based buffer overflow in the submitForm function. Opening a crafted PDF can corrupt heap memory and potentially allow arbitrary code execution in the context of the current user.

Impact

An attacker who gets a victim to open a malicious PDF can potentially execute arbitrary code with the privileges of the current user, leading to full compromise of the user's session and data.

Attack surface

The flaw is reached locally when the user opens a crafted .pdf file in Acrobat Reader; no authentication is required, but user interaction (opening the file) is required per the CVSS vector (AV:L/UI:R).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is high (0.52718, 98.9th percentile), indicating elevated likelihood of exploitation activity, but the record does not confirm in-the-wild exploitation.

What to do

• Update Adobe Acrobat Reader DC and Acrobat to the fixed versions listed in Adobe advisory APSB20-67.
• If immediate patching is not possible, restrict opening of untrusted PDFs and disable or limit JavaScript and form submission features in Acrobat Reader.
• Enforce application allowlisting and block execution of Acrobat Reader from untrusted locations or with untrusted file associations.
• Educate users not to open PDF attachments or links from unknown or unexpected sources.

Detection

• Monitor for Acrobat Reader processes spawning child processes or making unexpected network connections after opening PDFs.
• Use endpoint detection to flag heap corruption or crash patterns in Acrobat Reader, especially involving submitForm or form submission actions.
• Search email and web gateways for PDFs that trigger form submission or contain suspicious JavaScript, and correlate with Acrobat Reader execution events.
• Review Acrobat Reader version inventory to identify unpatched endpoints still running the affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.