CVE-2020-9715: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier contain a use-after-free vulnerability (CVE-2020-9715) discovered by Mark Vincent Yason. The vulnerability was reported through the Zero Day Initiative program and was patched in August 2020. The flaw exists within the handling of ESObject data objects in the EScript.api module (ZDI Advisory, Adobe Advisory).

The vulnerability stems from improper validation of object existence prior to performing operations on ESObject data objects. The issue occurs due to a mismatch in the encoding of name strings during the construction of cache keys used in the insertion and deletion phases of a data ESObject's lifecycle. When a data ESObject is created and added to the cache, the name retains its original encoding (ANSI or Unicode), but when deleted, the name is always encoded in Unicode. This leads to cache entries with ANSI names never being purged, leaving stale pointers to freed objects. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current process. An attacker could leverage this vulnerability to execute malicious code and potentially take control of the affected system (Exodus Intel).

The vulnerability requires user interaction to be exploited, specifically the target must open a malicious PDF file. Detailed technical analysis has shown that the vulnerability can be exploited to achieve arbitrary code execution by bypassing security mitigations including ASLR, DEP, and Control Flow Guard (Exodus Intel).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader. The fix was included in the APSB20-48 security bulletin (Adobe Advisory).