CVE-2024-20734: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability identified as CVE-2024-20734. The vulnerability was discovered in December 2023 and publicly disclosed on February 13, 2024. This security flaw affects both Windows and macOS versions of Adobe Acrobat and Reader (NVD, ZDI).

The vulnerability is classified as a Use After Free (CWE-416) flaw that exists within the handling of AcroForms. The issue stems from the lack of validating the existence of an object prior to performing operations on it. The vulnerability has received a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD, ZDI).

If successfully exploited, this vulnerability could lead to disclosure of sensitive memory and potentially allow attackers to bypass security mitigations such as ASLR (Address Space Layout Randomization). The vulnerability primarily affects the confidentiality of the system, with no direct impact on integrity or availability (NVD).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a malicious file. The attack complexity is considered low, but requires local access to the target system. No privilege escalation is required for exploitation (NVD, ZDI).

Adobe has released security updates to address this vulnerability. Users should update to the latest versions of Adobe Acrobat and Reader. The fix was included in Adobe's security bulletin APSB24-07 (Adobe Advisory).