CVE-2020-9607: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier contain a use-after-free vulnerability that could lead to arbitrary code execution. The vulnerability was discovered by Aleksandar Nikolic of Cisco Talos and was publicly disclosed on May 12, 2020 (Talos Report).

The vulnerability exists in the way Adobe Reader handles the destruction of annotations from inside event handlers. When manipulating annotations attached to pages in PDF through JavaScript, a specific sequence of actions can trigger a use-after-free condition. The vulnerability occurs when an annotation is destroyed twice, where the second destruction attempt operates on an already freed object. This vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current user. The vulnerability can be triggered by opening a malicious PDF file or accessing a malicious web page, making it particularly dangerous given Adobe Reader's widespread use and its integration with web browsers as a plugin for rendering PDFs (Talos Report).

The vulnerability requires user interaction to be exploited, specifically opening a malicious PDF document or accessing a malicious web page. With careful memory manipulation between the time of free and reuse, an attacker can gain control over reused memory, potentially leading to arbitrary code execution (Talos Report).

Adobe has released security updates to address this vulnerability. Users should update to the latest version of Adobe Acrobat and Reader (Adobe Advisory).