CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Adobe Acrobat Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
Affected products
adobe: acrobat dc; adobe: acrobat reader dc; apple: macos; microsoft: windows
References7
- helpx.adobe.com/security/products/acrobat/apsb20-48.html Vendor Advisory
- helpx.adobe.com/security/products/acrobat/apsb20-48.html Vendor Advisory
- blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vu… ExploitPatchThird Party Advisory
- blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vu… ExploitPatchThird Party Advisory
- www.zerodayinitiative.com/advisories/ZDI-20-991/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-20-991/ Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 33% percentile: 98 · as of 2 November 2026
- CWE
- CWE-416