7.8Hoch KEV

CVE-2020-9715Adobe Acrobat Use-After-Free Vulnerability

Adobe Adobe Acrobat and Reader Veröffentlicht: 2020-08-19 03:00 (vor 6 Jahren)

Bekannt ausgenutzt — Adobe Acrobat Use-After-Free Vulnerability

CISA hat am 13.04.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 27.04.2026.

Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

Beschreibung

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
adobe	acrobat dc	15.006.30060 – ≤ 15.006.30523
adobe	acrobat reader dc	15.006.30060 – ≤ 15.006.30523
Adobe	Adobe Acrobat and Reader	2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier versions

Referenzen und Patches

https://www.zerodayinitiative.com/advisories/ZDI-20-991/ Third Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb20-48.html Vendor Advisory
https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/ ExploitPatchThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715 US Government Resource

CPE-Treffer (NVD) (8)

cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30523
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 20.009.20074
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30171
cpe:2.3:a:adobe:acrobat_dc:20.001.30002:*:*:*:classic:*:*:*
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 15.006.30060 ≤ 15.006.30523
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.008.20082 ≤ 20.009.20074
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* ≥ 17.011.30059 ≤ 17.011.30171
cpe:2.3:a:adobe:acrobat_reader_dc:20.001.30002:*:*:*:classic:*:*:*

CVSS-Score

7.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.8Hoch
nvd	CVSS 3.1	7.8Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Hoch
nvd	CVSS 2.0	9.3Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

33.26%

höher als 98 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2020-03-02
Veröffentlicht2020-08-19 03:00
Bei IP-DB eingegangen2026-10-24 23:29
In KEV aufgenommen2026-04-13
Zuletzt aktualisiert2026-06-17 06:28

Vergeben von (CNA): adobe
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Adobe Acrobat / Reader

8.8Hoch

CVE-2026-100134 vor 14 Tagen

Acrobat for Edge | Out-of-bounds Write (CWE-787)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

4.3Mittel

CVE-2026-100132 vor 14 Tagen

Acrobat for Edge | Out-of-bounds Read (CWE-125)

Adobe Acrobat for Edge

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…

5.5Mittel

CVE-2026-81984 vor 1 Monat

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a vic…

7.8Hoch

CVE-2026-81989 vor 1 Monat

Acrobat Reader | Use After Free (CWE-416)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

5.5Mittel

CVE-2026-81991 vor 1 Monat

Acrobat Reader | Out-of-bounds Read (CWE-125)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that …

7.8Hoch

CVE-2026-81980 vor 1 Monat

Acrobat Reader | Out-of-bounds Write (CWE-787)

Adobe Adobe Acrobat; Adobe Acrobat Reader; Adobe Acrobat 2024

Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.