CVE-2024-30305: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability identified as CVE-2024-30305. This security flaw was discovered in January 2024 and publicly disclosed on May 2, 2024. The vulnerability affects Adobe Acrobat Reader DC, specifically in the handling of AcroForms (ZDI Advisory, NVD).

The vulnerability is classified as a Use After Free (CWE-416) issue that exists within the handling of AcroForms. The specific flaw results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has received a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. This means an attacker could potentially execute malicious code with the same privileges as the user running the Adobe Acrobat Reader application (NVD).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a malicious file. The vulnerability was discovered and reported to Adobe on January 17, 2024, by security researcher Mark Vincent Yason (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Acrobat Reader installations to the latest version available through the official Adobe security bulletin (Adobe Advisory).