CVE-2024-30302: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability (CVE-2024-30302) that was disclosed on May 2, 2024. The vulnerability affects Adobe Acrobat and Reader applications on both Windows and macOS operating systems (Adobe Advisory).

The vulnerability is classified as a Use After Free (CWE-416) flaw that exists within the handling of AcroForms. The specific issue results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has received a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (ZDI Advisory, Adobe Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive memory and potentially allow attackers to bypass security mitigations such as ASLR. The vulnerability only affects confidentiality, with no impact on integrity or availability of the system (NVD).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a malicious file. The attack complexity is considered low, but requires local access to the target system (NVD).

Adobe has released security updates to address this vulnerability. Users should update to versions newer than 20.005.30539 for classic track or 23.008.20470 for continuous track (Adobe Advisory).

The vulnerability was initially reported to Adobe on January 17, 2024, by security researcher Mark Vincent Yason, and was publicly disclosed on May 7, 2024, following a coordinated release (ZDI Advisory).