CVE-2020-24437

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Adobe	Acrobat Reader	>= unspecified, <= 2017.011.30175; >= unspecified, <= 2020.012.20048; >= unspecified, <= 2020.001.30005; >= unspecified, <= None

References

https://helpx.adobe.com/security/products/acrobat/apsb20-67.htmlVendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1156Third Party Advisory
https://helpx.adobe.com/security/products/acrobat/apsb20-67.htmlVendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1156Third Party Advisory

Timeline

Published: Nov 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-244383.3Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use CVE-2020-244392.8Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affecte CVE-2020-244407.0Adobe Prelude version 9.0.1 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution i CVE-2020-244415.5Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. T CVE-2020-244426.1Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to conv CVE-2020-244436.1Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to conv CVE-2020-244445.8AEM Forms SP6 add-on for AEM 6.5.6.0 and Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2) have a blind Server CVE-2020-244459.0AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that CVE-2020-244477.0Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in CVE-2020-244485.5Uncaught exception in some Intel(R) Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable deni CVE-2020-244507.8Improper conditions check in some Intel(R) Graphics Drivers before versions 26.20.100.8141, 15.45.32.5145 and 15.40.46.5144 may allow an aut CVE-2020-244517.3Uncontrolled search path in the Intel(R) Optane(TM) DC Persistent Memory installer for Windows* before version 1.00.00.3506 may allow an aut