CVE-2020-9712: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2020-9712 is a security bypass vulnerability affecting Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier. The vulnerability was first reported on June 2, 2020, and was publicly disclosed on August 12, 2020 (ZDI Advisory, Adobe Advisory).

The vulnerability exists within a hidden menu item in Adobe Acrobat Pro DC. The specific flaw allows for the parsing of arbitrary HTML documents through JavaScript actions. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating local access is required with user interaction (NVD). The vulnerability is classified under CWE-863 (Incorrect Authorization).

Successful exploitation of this vulnerability could lead to security feature bypass. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (ZDI Advisory).

Adobe has issued an update to correct this vulnerability. Users should update to the latest version of Adobe Acrobat and Reader as detailed in the security bulletin (Adobe Advisory).