CVE-2020-24433: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2020-24433 is a local privilege escalation vulnerability affecting Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. The vulnerability was discovered by Lasse Trolle Borup of Danish Cyber Defence and disclosed in November 2020. This security flaw could enable users without administrator privileges to delete arbitrary files and potentially execute arbitrary code with SYSTEM privileges (NVD Database).

The vulnerability is classified as an improper access control issue (CWE-284) with a CVSS v3.1 base score of 7.8 (HIGH) and a CVSS v2.0 score of 9.3 (HIGH). The vulnerability vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access is required and user interaction is necessary for exploitation (NVD Database).

If successfully exploited, this vulnerability could allow an attacker to delete arbitrary files and potentially execute arbitrary code with SYSTEM privileges. The impact is particularly severe as it could lead to complete system compromise through privilege escalation (NVD Database).

Exploitation of this vulnerability requires either social engineering of a victim or pre-existing access to the environment. The vulnerability has a 'priority 2' rating, indicating it affects a product that has historically been at elevated risk. Adobe has noted that there were no known exploits in the wild at the time of disclosure (Threatpost).

Users are advised to update to Acrobat DC and Acrobat Reader DC Continuous version 2020.013.20064, Acrobat and Acrobat Reader Classic 2020 version 2020.001.30010, or Acrobat and Acrobat Reader Classic 2017 version 2017.011.30180. The update can be installed manually by choosing Help > Check for Updates, or the product will update automatically when updates are detected (Threatpost).