erroneo.us
Search all guides⌘K

Security Digest · Aug 11, 2020 · Vulnerability · Other

Adobe Acrobat CVE-2020-9715: 2020 Use-After-Free in KEV

A 2020 Acrobat and Reader use-after-free, fixed in APSB20-48 (2020.012.20041), joined CISA KEV in April 2026. Find old and end-of-life Acrobat installs.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Patched in August 2020 with a public exploit write-up since 2021; the KEV listing matters only where Acrobat or Reader is years out of date, which is most likely on end-of-life Classic installs and frozen images.

Who must act: Organizations with Acrobat or Reader installs that do not auto-update, especially the old Classic 2015, 2017 and 2020 tracks, VDI or kiosk images, and machines where updates were disabled.

Who can relax: Users of Acrobat or Reader DC on the Continuous track that has auto-updated since August 2020, and anyone already current with Adobe's 2026 bulletins.

Affected
Acrobat DC and Acrobat Reader DC (Continuous) 2020.009.20074 and earlier
Acrobat 2020 and Acrobat Reader 2020 (Classic 2020) 2020.001.30002
Acrobat 2017 and Acrobat Reader 2017 (Classic 2017) 2017.011.30171 and earlier
Acrobat 2015 and Acrobat Reader 2015 (Classic 2015) 2015.006.30523 and earlier
Fixed in
Acrobat DC and Acrobat Reader DC 2020.012.20041
Classic 2020: 2020.001.30005
Classic 2017: 2017.011.30175
Classic 2015: 2015.006.30527
Classic 2017 and 2020 are out of support; move to a current Continuous or Classic 2024 release
CVSS
7.8 (v3.1, NVD)
EPSS
33.5% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
  2. Update the Continuous track to the current release with Help > Check for Updates or your deployment tool; anything at or above APSB26-43 (26.001.21411) also covers the April 2026 zero-day.
  3. Replace Classic 2017 and 2020 installs, which no longer receive security updates, and any older Classic 2015 installs with a supported release.
  4. Where workflows allow, turn off Acrobat JavaScript, since this bug and its public exploit run through the JavaScript engine.
  5. Re-enable automatic updates wherever they were disabled for Acrobat or Reader.

How to check if you are affected or compromised

  • Search endpoint inventory for Acrobat or Reader versions below 2020.012.20041 (or the Classic equivalents) and treat every hit as exposed.
  • Review EDR telemetry for Acrobat.exe or AcroRd32.exe spawning cmd, PowerShell, script hosts or unsigned binaries, which is unusual for a PDF reader.
  • Check mail and web gateway logs for PDF attachments with embedded JavaScript delivered to users of old installs.

What happened#

On August 11, 2020, Adobe published APSB20-48, a batch of fixes for Acrobat and Reader on Windows and macOS. One of them, CVE-2020-9715, is a critical use-after-free that can lead to arbitrary code execution as the current user. Mark Vincent Yason reported it through Trend Micro's Zero Day Initiative on June 24, 2020. ZDI-20-991 places the flaw in the handling of ESObject data objects. It says the target must open a malicious file or visit a malicious page.

In April 2021, Exodus Intelligence published a full analysis. The bug sits in a cache of data ESObjects in EScript.api, the module that runs embedded JavaScript. Entries added under ANSI names were never evicted, so they kept pointers to freed objects. Exodus described a working exploit for Reader DC 2020.009.20063 on 64-bit Windows 10 that bypassed ASLR, DEP and CFG.

On April 13, 2026, CISA added the CVE to the KEV catalog with an April 27 deadline. CISA marks ransomware use as unknown. The same day it added CVE-2026-34621, an Acrobat zero-day that Adobe fixed on April 11 in APSB26-43. No public source links the two. SecurityWeek found no reports of in-the-wild exploitation before CISA's listing and noted that proof-of-concept code had been public for years. CISA did not publish its evidence. As of Oct 23, 2026, who exploited the bug, when, and against whom has not been disclosed. In May 2026, CISA also added CVE-2009-3459, another old Acrobat bug.

Who is affected#

Per the bulletin: Acrobat and Reader DC 2020.009.20074 and earlier, Classic 2020 build 2020.001.30002, Classic 2017 2017.011.30171 and earlier, and Classic 2015 2015.006.30523 and earlier. The fixes are 2020.012.20041, 2020.001.30005, 2017.011.30175 and 2015.006.30527. The 2017 and 2020 tracks are already out of support, and 2015 is older than both. Adobe ended support for Acrobat 2017 on June 6, 2022, citing its five-year lifecycle policy. Acrobat 2020 reached end of support on November 30, 2025.

Do you really need to act?#

Only where Acrobat or Reader is badly out of date. The Continuous track updates itself, and the fix is six years old. The CVE record carries CISA's CVSS 3.1 score of 7.8, a local vector that needs user interaction, and NVD agrees. Someone has to open a booby-trapped PDF. Exposure clusters in perpetual-license Classic installs, golden images and machines where IT turned updates off. Western Australia's WASOC reported no exploitation on its government networks.

What to do now#

  1. Inventory versions. On Windows: Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Acrobat*' | Select-Object DisplayName, DisplayVersion.
  2. Update the Continuous track to the current release. Anything at or above 26.001.21411 also fixes CVE-2026-34621.
  3. Replace Classic 2017 and 2020 installs, and anything older, with a supported release.
  4. Where workflows allow, turn off Acrobat JavaScript, which this exploit depends on.
  5. Re-enable automatic updates wherever they were disabled.

How to tell if you were hit#

No indicators have been published. Treat any install below the fixed builds as exposed. Review EDR data for Acrobat.exe or AcroRd32.exe launching shells, script hosts or unsigned binaries. Check mail gateway logs for PDFs with embedded JavaScript sent to users of old installs.

Timeline#

  • — ZDI reports the bug to Adobe.
  • — Adobe releases APSB20-48.
  • — ZDI publishes ZDI-20-991.
  • — Exodus Intelligence publishes its exploit analysis.
  • — CISA adds CVE-2020-9715 to KEV.
  • — KEV remediation deadline.

Vulnerability records

  • CVE-2020-9715 · KEV 2026-04-13 · Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Adobe — APSB20-48: Security update available for Adobe Acrobat and Reader (archived Oct 16, 2026) web.archive.org
  2. CVE record — CVE-2020-9715 cve.org
  3. NVD — CVE-2020-9715 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2020-9715 cisa.gov
  5. Zero Day Initiative — ZDI-20-991: Adobe Acrobat Reader DC ESObject Use-After-Free Remote Code Execution Vulnerability zerodayinitiative.com
  6. Exodus Intelligence — Analysis of a Use-After-Free Vulnerability in Adobe Acrobat Reader DC blog.exodusintel.com
  7. Adobe — APSB26-43: Security update available for Adobe Acrobat Reader (archived) web.archive.org
  8. Adobe — End of sale for Acrobat 2020 in TLP and CLP (archived) web.archive.org
  9. Adobe — End of support for Adobe Acrobat 2017 Classic and Acrobat Reader 2017 Classic (archived) web.archive.org
  10. WA Cyber Security Unit — Adobe Reader Vulnerability 20260414002 soc.cyber.wa.gov.au

Coverage and analysis

  1. SecurityWeek — Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities securityweek.com