CVE-2020-24436: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Pro DC and Reader were affected by an out-of-bounds write vulnerability (CVE-2020-24436) discovered in 2020. The vulnerability affected multiple versions including Acrobat Pro DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. This security flaw could result in writing past the end of an allocated memory structure, requiring user interaction through opening a malicious document to exploit (NVD, ZDI Advisory).

The vulnerability was assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the exporting of PDF files and results from the lack of proper validation of user-supplied data. The issue was classified as CWE-787 (Out-of-bounds Write) (NVD, ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The vulnerability could enable attackers to take control of affected systems, potentially leading to code execution with the privileges of the current user (ZDI Advisory, Threatpost Article).

The vulnerability requires user interaction to exploit, specifically requiring the target to open a malicious file. Adobe assigned this vulnerability a Priority 2 rating, indicating that while there were no known exploits at the time, the product has historically been at elevated risk (Threatpost Article).

Adobe released patches to address this vulnerability. Users were advised to update to Acrobat DC and Acrobat Reader DC Continuous version 2020.013.20064, Acrobat and Acrobat Reader Classic 2020 version 2020.001.30010, or Acrobat and Acrobat Reader Classic 2017 version 2017.011.30180. The update could be installed manually through Help > Check for Updates or would be applied automatically when updates were detected (Threatpost Article).