Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Acrobat Reader: Malicious Files Can Run Code on Your Computer

CVE-2024-41831 · published 2 years ago
Summary

If you use an outdated version of Acrobat Reader, a hacker can trick you into opening a malicious file, which could allow them to run code on your computer. This could lead to your data being stolen or your computer being taken over. Update your Acrobat Reader to the latest version to fix this issue.

What to do
  • Update adobe acrobat_dc to version 24.002.21005 or later.
  • Update adobe acrobat_reader to version 20.005.30655 or later.
  • Update adobe acrobat_reader_dc to version 24.002.21005 or later.
Affected software
VendorProductAffected versions
adobe acrobat >= 20.001.30005, < 20.005.30655
>= 24.001.20604, < 24.001.30159
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*
adobe acrobat_dc >= 15.008.20082, < 24.002.21005
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
adobe acrobat_reader >= 20.001.3005, < 20.005.30655
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*
adobe acrobat_reader_dc >= 15.008.20082, < 24.002.21005
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*
Original advisory text
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex...
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published14 Aug 2024
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-41831 · NVD
Track software like this
Free during beta