CVE-2020-9715
Adobe Acrobat Use-After-Free Vulnerability
Description
CVE-2020-9715 is a HIGH-severity use-after-free vulnerability in Adobe Acrobat and Adobe Acrobat Reader (the Acrobat DC product family) that can lead to arbitrary code execution on the user's machine. The flaw carries a CVSS 3.1 score of 7.8 and affects Acrobat DC and Acrobat Reader DC versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier. Exploitation requires a victim to open a malicious PDF, after which an attacker can execute code in the context of the current user. CVE-2020-9715 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming real-world attacks, and its EPSS score of 0.75863 (98.9th percentile) places it among the most actively exploited vulnerabilities tracked by EPSS.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat dc | >= 15.006.30060, <= 15.006.30523; >= 15.008.20082, <= 20.009.20074; >= 17.011.30059, <= 17.011.30171; 20.001.30002 |
| adobe | acrobat reader dc | >= 15.006.30060, <= 15.006.30523; >= 15.008.20082, <= 20.009.20074; >= 17.011.30059, <= 17.011.30171; 20.001.30002 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/(Exploit, Patch, Third Party Advisory)
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2020-9715 is classified under CWE-416 — Use After Free. A use-after-free vulnerability occurs when software continues to use a pointer after the memory it references has been freed; if the dangling pointer is later dereferenced, the program may read or write memory that now holds different data, enabling data corruption, information disclosure, or code execution. In Adobe Acrobat and Acrobat Reader DC, malformed objects inside a crafted PDF drive the application to reuse a freed object whose memory has been reclaimed by attacker-controlled data, giving the attacker a primitive that is routinely chained into arbitrary code execution.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2020-9715 carries a CVSS 3.1 score of 7.8 (HIGH) with an unchanged scope, reflecting severe impact confined to the process running Adobe Acrobat or Adobe Acrobat Reader DC. Attack Vector (Local): the attacker delivers a malicious PDF that must be opened by the victim; exploitation is not remotely reachable without user participation. Attack Complexity (Low): no special conditions are required beyond convincing the user to open the file. Privileges Required (None): the attacker does not need an account on the target; any user who opens the PDF is sufficient. User Interaction (Required): the victim must open the crafted document, typically via email attachment, drive-by download, or a shared link. Confidentiality, Integrity, and Availability (all High): successful exploitation yields arbitrary code execution in the user's security context, allowing theft of documents and credentials, installation of persistent malware, modification of files, and loss of workstation availability. With an EPSS score of 0.75863 in the 98.9th percentile and confirmed listing in CISA's KEV catalog, CVE-2020-9715 should be treated as an actively exploited Acrobat vulnerability that requires immediate remediation.
Exploit Maturity
CVE-2020-9715 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-13, federal remediation deadline 2026-04-27), meaning CISA has observed this Adobe Acrobat use-after-free being weaponized in the wild. The EPSS score of 0.75863 at the 98.9th percentile indicates a near-certain likelihood of continued exploitation activity — this CVE sits in the top ~1% of vulnerabilities by predicted exploit volume. Public exploit analysis is available: Exodus Intelligence published a detailed write-up of a use-after-free in Adobe Acrobat Reader DC at blog.exodusintel.com, and the Zero Day Initiative advisory ZDI-20-991 documents the vulnerability; together these references confirm that technical detail sufficient to reproduce exploitation is publicly available. KEV does not flag known ransomware use for CVE-2020-9715, but given the EPSS profile and the proven use of Acrobat exploits in phishing and initial-access operations, organizations should treat patching as urgent.
Remediation
- Apply Adobe's security update for CVE-2020-9715 without delay. Per CISA's KEV required action, apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The vendor advisory is APSB20-48.
- Upgrade every vulnerable Acrobat DC and Acrobat Reader DC install. Affected tracks include Acrobat DC / Acrobat Reader DC Continuous (≤ 20.009.20074), Classic 2020 (20.001.30002), Classic 2017 (≤ 17.011.30171), and Classic 2015 (≤ 15.006.30523). Upgrade to the fixed releases listed in APSB20-48 and remove or block any end-of-life Acrobat installations still present in the environment.
- Restrict untrusted PDFs while patching rolls out. Enable Adobe's Protected View and Protected Mode (sandbox) for all users, block outbound JavaScript from PDFs via enterprise policy, strip or quarantine PDF attachments at the email gateway, and consider temporarily rendering PDFs server-side (e.g. via a gateway or browser-based viewer) for high-risk users.
- Hunt for signs of prior exploitation. Because CVE-2020-9715 is KEV-listed and highly active (EPSS 0.75863), review EDR telemetry for Acrobat or AcroRd32 spawning suspicious children (cmd.exe, powershell.exe, rundll32.exe), unexpected script execution, or outbound connections from the reader process, and triage historical PDF-delivery campaigns against this CVE.
- Update detection content. Refresh antivirus, EDR, email gateway, and IDS/IPS signatures to cover exploitation of CVE-2020-9715 and the broader pattern of PDF-based use-after-free exploits.
- Reduce long-term exposure to CWE-416 use-after-free flaws in document readers. Enforce least-privilege on user endpoints, maintain an aggressive Acrobat update cadence, enable OS-level exploit mitigations (Windows Exploit Guard, macOS Hardened Runtime), and where feasible migrate high-risk groups to sandboxed or browser-based PDF viewing.
Technical Details
CVE-2020-9715 is a use-after-free vulnerability in Adobe Acrobat and Acrobat Reader DC that attackers trigger by persuading a user to open a crafted PDF. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a local, low-complexity attack that requires no authentication but does require user interaction. Vulnerability mechanism: processing specific PDF objects causes Acrobat to free a heap-allocated object while retaining a pointer to it; subsequent operations dereference that dangling pointer, and attackers who have sprayed the heap with controlled content gain read/write primitives over reclaimed memory. Exploitation chain: heap manipulation techniques place attacker-controlled objects into the freed slot so that the reused pointer references predictable data, which is then chained — typically through a type confusion or vtable overwrite — into arbitrary code execution within the Acrobat process. Impact profile: because the scope is Unchanged and Privileges Required is None while User Interaction is Required, the attacker does not need credentials but must lure the victim into opening the file; once that happens, the HIGH/HIGH/HIGH confidentiality, integrity, and availability impact translates to full control of the user's Acrobat session and, by extension, any data or credentials reachable from that user context.
Frequently Asked Questions
Is CVE-2020-9715 being actively exploited?
Yes. CVE-2020-9715 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming observed exploitation in the wild. Its EPSS score of 0.75863 (98.9th percentile) indicates near-certain ongoing exploitation activity, and U.S. federal agencies were required to remediate by 2026-04-27.
What products are affected by CVE-2020-9715?
CVE-2020-9715 affects Adobe Acrobat DC and Adobe Acrobat Reader DC on the Continuous track (versions 2020.009.20074 and earlier), Classic 2020 (20.001.30002), Classic 2017 (2017.011.30171 and earlier), and Classic 2015 (2015.006.30523 and earlier). Any workstation running an unpatched version from these tracks is exposed.
How do I fix CVE-2020-9715?
Upgrade Adobe Acrobat and Acrobat Reader DC to the fixed releases listed in Adobe advisory APSB20-48, and remove end-of-life Acrobat installations from the environment. Until patching completes, enable Protected View and Protected Mode, block or sandbox untrusted PDFs at the email gateway, and hunt for Acrobat processes launching suspicious child processes as an indicator of exploitation.
How severe is CVE-2020-9715?
CVE-2020-9715 is rated HIGH with a CVSS 3.1 score of 7.8. Successful exploitation yields arbitrary code execution in the user's context with HIGH impact on confidentiality, integrity, and availability, and the EPSS score of 0.75863 (98.9th percentile) places this Adobe Acrobat use-after-free vulnerability among the most likely to be exploited — immediate remediation is strongly recommended.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.