CVE-2020-24437: Adobe Acrobat Reader use-after-free in Format event action processing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.8) code execution in a ubiquitous client with very high EPSS, though no KEV listing or known in-the-wild exploitation is recorded.

What it is

Adobe Acrobat Reader DC (and Acrobat) versions 2020.012.20048, 2020.001.30005 and 2017.011.30175 and earlier contain a use-after-free (CWE-416) when processing Format event actions. A crafted PDF can corrupt memory and lead to code execution in the context of the current user. Because Reader is widely deployed and PDFs are routinely exchanged, this is a realistic client-side attack target.

Impact

An attacker who gets a victim to open a malicious file can execute arbitrary code with the privileges of the logged-in user, enabling data theft, further payload installation or lateral movement from that host.

Attack surface

Reached locally by opening a crafted PDF in the affected Acrobat or Reader build; no authentication is required, but user interaction (opening the file) is required per the CVSS vector AV:L/PR:N/UI:R.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high (0.46549, ~98.8th percentile), indicating elevated likelihood of exploitation activity; references are vendor and third-party advisories only, with no public exploit tag.

What to do

• Update Acrobat and Acrobat Reader to the fixed versions in Adobe advisory APSB20-67 (or later) on all endpoints.
• If immediate patching is not possible, restrict or disable JavaScript and non-essential PDF action handling in Reader where policy allows.
• Block untrusted PDF attachments at the mail and web gateway and enforce Mark-of-the-Web/Protected View style controls for downloaded PDFs.
• Run Reader with reduced privileges and keep EDR/ASR rules that block Office and PDF readers from spawning child processes.
• Inventory endpoints still running the affected 2017, 2020.001 and 2020.012 branches and prioritize them for remediation.

Detection

• Monitor for Acrobat/Reader processes spawning cmd.exe, powershell.exe, wscript.exe or other unexpected child processes.
• Hunt for PDF files containing Format event actions or embedded JavaScript that trigger memory corruption behavior, and alert on Reader crashes correlated with file opens.
• Review EDR telemetry for Reader writing executables or DLLs to user-writable paths or making unusual outbound network connections after opening a document.
• Track endpoint versions against APSB20-67 fixed builds and alert on hosts still running the vulnerable branches.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.