CVE-2020-9695: Adobe Acrobat Reader Out-of-Bounds Write RCE Vulnerability

Technical summary

CVE-2020-9695 is an out-of-bounds write vulnerability (CWE-787) in Adobe Acrobat Reader that enables arbitrary code execution with the privileges of the logged-in user. The flaw exists in Acrobat Reader 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier versions running on Windows and macOS. The out-of-bounds write condition permits an attacker to overwrite adjacent memory regions, leading to code execution in the reader's process context. Exploitation mandates user interaction—specifically, opening a malicious PDF file.

Business impact

A successful attack leveraging this vulnerability could lead to unauthorized access to sensitive documents, lateral movement within corporate networks via compromised user accounts, intellectual property theft, and potential ransomware deployment. Organizations relying on Acrobat Reader for document workflows face elevated risk, particularly if users receive external PDFs from untrusted sources. The requirement for user interaction limits blast radius but increases social engineering risk vectors.

Affected systems

Adobe Acrobat Reader DC, Adobe Acrobat DC, and related versions on both Windows and macOS platforms are vulnerable. Specific affected versions include 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and all earlier releases. Organizations using legacy Acrobat Reader versions face extended exposure.

Exploitability

Exploitation requires user interaction and local file access. An attacker must craft a malicious PDF and convince a victim to open it—typically through email, file sharing platforms, or web downloads. Once opened, the out-of-bounds write is triggered, allowing code execution. The CVSS score of 7.8 (HIGH) reflects the high impact (confidentiality, integrity, availability all affected) combined with the local attack vector and user interaction requirement. This is not a wormable vulnerability, but it is highly effective in targeted attacks against organizations handling sensitive documents.

Remediation

Adobe has released patched versions addressing this vulnerability. Verify the specific patch versions applicable to your environment against Adobe's security advisory. Users should upgrade Acrobat Reader DC and related products to the latest available version. Organizations should implement a phased rollout plan prioritizing business-critical systems and high-risk user groups.

Patch guidance

Update Adobe Acrobat Reader to a version released after the publication of this CVE. Consult Adobe's official security advisory for exact patch version numbers and supported upgrade paths for your specific Acrobat product and operating system. Test patches in a non-production environment before enterprise deployment. For users unable to patch immediately, consider disabling PDF opening in email clients and restricting file type execution policies.

Detection guidance

Monitor for suspicious PDF files in email gateways and file sharing systems. Endpoint detection and response (EDR) tools should track unusual process execution spawned from Acrobat Reader, including unexpected network connections or file system modifications. Look for crash logs and application errors in Acrobat Reader processes, which may indicate exploitation attempts. Network indicators include anomalous outbound connections from systems opening untrusted PDFs.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH severity score, wide product coverage, and prevalence of Acrobat Reader in enterprise environments. Although user interaction is required, the social engineering required is straightforward—sending a malicious PDF is a common attack pattern. The vulnerability affects multiple product lines and legacy versions still in use across organizations, expanding the affected population.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects high impact across all three security dimensions (confidentiality, integrity, availability compromise), a local attack vector, low attack complexity, and no privilege requirements. User interaction is required, which moderates the score slightly. The out-of-bounds write primitive is a well-understood exploitation technique with reliable code execution paths, contributing to the HIGH severity assessment.

Frequently asked questions