---
title: "Adobe Acrobat CVE-2020-9715: 2020 Use-After-Free in KEV"
url: https://erroneo.us/security/briefs/adobe-acrobat-reader-cve-2020-9715-esobject-use-after-free/
description: "A 2020 Acrobat and Reader use-after-free, fixed in APSB20-48 (2020.012.20041), joined CISA KEV in April 2026. Find old and end-of-life Acrobat installs."
type: security-brief
section: "Security Digest"
date_published: 2020-08-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2020-9715"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Adobe Acrobat CVE-2020-9715: 2020 Use-After-Free in KEV

**Verdict: Check exposure.** Patched in August 2020 with a public exploit write-up since 2021; the KEV listing matters only where Acrobat or Reader is years out of date, which is most likely on end-of-life Classic installs and frozen images.

- **Who must act:** Organizations with Acrobat or Reader installs that do not auto-update, especially the old Classic 2015, 2017 and 2020 tracks, VDI or kiosk images, and machines where updates were disabled.
- **Who can relax:** Users of Acrobat or Reader DC on the Continuous track that has auto-updated since August 2020, and anyone already current with Adobe's 2026 bulletins.
- **Affected:** Acrobat DC and Acrobat Reader DC (Continuous) 2020.009.20074 and earlier; Acrobat 2020 and Acrobat Reader 2020 (Classic 2020) 2020.001.30002; Acrobat 2017 and Acrobat Reader 2017 (Classic 2017) 2017.011.30171 and earlier; Acrobat 2015 and Acrobat Reader 2015 (Classic 2015) 2015.006.30523 and earlier
- **Fixed:** Acrobat DC and Acrobat Reader DC 2020.012.20041; Classic 2020: 2020.001.30005; Classic 2017: 2017.011.30175; Classic 2015: 2015.006.30527; Classic 2017 and 2020 are out of support; move to a current Continuous or Classic 2024 release
- **CVEs:** CVE-2020-9715
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
2. Update the Continuous track to the current release with Help > Check for Updates or your deployment tool; anything at or above APSB26-43 (26.001.21411) also covers the April 2026 zero-day.
3. Replace Classic 2017 and 2020 installs, which no longer receive security updates, and any older Classic 2015 installs with a supported release.
4. Where workflows allow, turn off Acrobat JavaScript, since this bug and its public exploit run through the JavaScript engine.
5. Re-enable automatic updates wherever they were disabled for Acrobat or Reader.

### How to check if you are affected

- Search endpoint inventory for Acrobat or Reader versions below 2020.012.20041 (or the Classic equivalents) and treat every hit as exposed.
- Review EDR telemetry for Acrobat.exe or AcroRd32.exe spawning cmd, PowerShell, script hosts or unsigned binaries, which is unusual for a PDF reader.
- Check mail and web gateway logs for PDF attachments with embedded JavaScript delivered to users of old installs.

## What happened

On August 11, 2020, Adobe published [APSB20-48](http://web.archive.org/web/20261016183923/https://helpx.adobe.com/security/products/acrobat/apsb20-48.html), a batch of fixes for Acrobat and Reader on Windows and macOS. One of them, CVE-2020-9715, is a critical use-after-free that can lead to arbitrary code execution as the current user. Mark Vincent Yason reported it through Trend Micro's Zero Day Initiative on June 24, 2020. [ZDI-20-991](https://www.zerodayinitiative.com/advisories/ZDI-20-991/) places the flaw in the handling of ESObject data objects. It says the target must open a malicious file or visit a malicious page.

In April 2021, [Exodus Intelligence](https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/) published a full analysis. The bug sits in a cache of data ESObjects in `EScript.api`, the module that runs embedded JavaScript. Entries added under ANSI names were never evicted, so they kept pointers to freed objects. Exodus described a working exploit for Reader DC 2020.009.20063 on 64-bit Windows 10 that bypassed ASLR, DEP and CFG.

On April 13, 2026, CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715) with an April 27 deadline. CISA marks ransomware use as unknown. The same day it added CVE-2026-34621, an Acrobat zero-day that Adobe fixed on April 11 in [APSB26-43](http://web.archive.org/web/20260917150235/https://helpx.adobe.com/security/products/acrobat/apsb26-43.html). No public source links the two. [SecurityWeek](https://www.securityweek.com/organizations-warned-of-exploited-windows-adobe-acrobat-vulnerabilities/) found no reports of in-the-wild exploitation before CISA's listing and noted that proof-of-concept code had been public for years. CISA did not publish its evidence. As of Oct 23, 2026, who exploited the bug, when, and against whom has not been disclosed. In May 2026, CISA also added CVE-2009-3459, another old Acrobat bug.

## Who is affected

Per the bulletin: Acrobat and Reader DC 2020.009.20074 and earlier, Classic 2020 build 2020.001.30002, Classic 2017 2017.011.30171 and earlier, and Classic 2015 2015.006.30523 and earlier. The fixes are 2020.012.20041, 2020.001.30005, 2017.011.30175 and 2015.006.30527. The 2017 and 2020 tracks are already out of support, and 2015 is older than both. Adobe ended support for Acrobat 2017 on June 6, 2022, [citing its five-year lifecycle policy](http://web.archive.org/web/20250708043513/https://helpx.adobe.com/acrobat/kb/end-of-support-acrobat-2017-reader-2017.html). [Acrobat 2020 reached end of support](http://web.archive.org/web/20260826031003/https://helpx.adobe.com/acrobat/kb/acrobat-perpetual-eos.html) on November 30, 2025.

## Do you really need to act?

Only where Acrobat or Reader is badly out of date. The Continuous track updates itself, and the fix is six years old. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2020-9715) carries CISA's CVSS 3.1 score of 7.8, a local vector that needs user interaction, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-9715) agrees. Someone has to open a booby-trapped PDF. Exposure clusters in perpetual-license Classic installs, golden images and machines where IT turned updates off. Western Australia's [WASOC](https://soc.cyber.wa.gov.au/advisories/20260414002-Adobe-Acrobat-use-after-free-vulnerability) reported no exploitation on its government networks.

## What to do now

1. Inventory versions. On Windows: `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Acrobat*' | Select-Object DisplayName, DisplayVersion`.
2. Update the Continuous track to the current release. Anything at or above 26.001.21411 also fixes CVE-2026-34621.
3. Replace Classic 2017 and 2020 installs, and anything older, with a supported release.
4. Where workflows allow, turn off Acrobat JavaScript, which this exploit depends on.
5. Re-enable automatic updates wherever they were disabled.

## How to tell if you were hit

No indicators have been published. Treat any install below the fixed builds as exposed. Review EDR data for `Acrobat.exe` or `AcroRd32.exe` launching shells, script hosts or unsigned binaries. Check mail gateway logs for PDFs with embedded JavaScript sent to users of old installs.

## Timeline

- Jun 24, 2020 — ZDI reports the bug to Adobe.
- Aug 11, 2020 — Adobe releases APSB20-48.
- Aug 12, 2020 — ZDI publishes ZDI-20-991.
- Apr 20, 2021 — Exodus Intelligence publishes its exploit analysis.
- Apr 13, 2026 — CISA adds CVE-2020-9715 to KEV.
- Apr 27, 2026 — KEV remediation deadline.

## Sources

1. [Adobe — APSB20-48: Security update available for Adobe Acrobat and Reader (archived Oct 16, 2026)](http://web.archive.org/web/20261016183923/https://helpx.adobe.com/security/products/acrobat/apsb20-48.html)
2. [CVE record — CVE-2020-9715](https://www.cve.org/CVERecord?id=CVE-2020-9715)
3. [NVD — CVE-2020-9715](https://nvd.nist.gov/vuln/detail/CVE-2020-9715)
4. [CISA — Known Exploited Vulnerabilities: CVE-2020-9715](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715)
5. [Zero Day Initiative — ZDI-20-991: Adobe Acrobat Reader DC ESObject Use-After-Free Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-20-991/)
6. [Exodus Intelligence — Analysis of a Use-After-Free Vulnerability in Adobe Acrobat Reader DC](https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/)
7. [Adobe — APSB26-43: Security update available for Adobe Acrobat Reader (archived)](http://web.archive.org/web/20260917150235/https://helpx.adobe.com/security/products/acrobat/apsb26-43.html)
8. [Adobe — End of sale for Acrobat 2020 in TLP and CLP (archived)](http://web.archive.org/web/20260826031003/https://helpx.adobe.com/acrobat/kb/acrobat-perpetual-eos.html)
9. [Adobe — End of support for Adobe Acrobat 2017 Classic and Acrobat Reader 2017 Classic (archived)](http://web.archive.org/web/20250708043513/https://helpx.adobe.com/acrobat/kb/end-of-support-acrobat-2017-reader-2017.html)
10. [WA Cyber Security Unit — Adobe Reader Vulnerability 20260414002](https://soc.cyber.wa.gov.au/advisories/20260414002-Adobe-Acrobat-use-after-free-vulnerability)
11. [SecurityWeek — Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities](https://www.securityweek.com/organizations-warned-of-exploited-windows-adobe-acrobat-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/adobe-acrobat-reader-cve-2020-9715-esobject-use-after-free/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt