CVE-2024-20731: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

A Use After Free (UAF) vulnerability (CVE-2024-20731) was discovered in Adobe Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier. The vulnerability exists in the FileAttachment PDAnnot object processing functionality and requires user interaction, specifically opening a malicious PDF file, to be exploited (Talos Report, Adobe Advisory).

The vulnerability resides in the FileAttachment PDAnnot object processing within Adobe Acrobat Reader. When a specially crafted JavaScript code inside a malicious PDF document is executed, it can trigger the reuse of a previously freed object, leading to memory corruption. The vulnerability occurs when the freed PDAnnot object is used without proper validation. The issue has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Talos Report).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. Depending on the memory layout of the process, an attacker could potentially achieve arbitrary read and write access to memory (Talos Report).

Adobe has released patches to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat Reader through the security bulletin APSB24-07 (Adobe Advisory).