Adobe Acrobat Use-After-Free Vulnerability (CVE-2020-9715)

Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

Published Aug 19, 2020 · Updated May 29, 2026

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

A local attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2026-04-27 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Use After Free (CWE-416) vulnerability in Adobe Acrobat. Exploitation requires local access, low attack complexity, no authentication required, and user interaction required.

Am I affected?Quick check

Probably yes if any of these apply:

●Endpoint Administrators

●IT Security

●Running acrobat dc: 15.006.30060 ≤ v ≤ 15.006.30523, 15.008.20082 ≤ v ≤ 20.009.20074, 17.011.30059 ≤ v ≤ 17.011.30171, 20.001.30002; acrobat reader dc: 15.006.30060 ≤ v ≤ 15.006.30523, 15.008.20082 ≤ v ≤ 20.009.20074, 17.011.30059 ≤ v ≤ 17.011.30171, 20.001.30002

Real-world incidentsWhat we've seen

Active exploitation documented in the wild. Threat-research write-up: https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.