CVE-2024-34095: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

Adobe Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability identified as CVE-2024-34095. The vulnerability was discovered by Mark Vincent Yason and reported through the Trend Micro Zero Day Initiative. This security flaw affects both Windows and macOS versions of Adobe Acrobat and Reader (Adobe Advisory, ZDI Advisory).

The vulnerability is classified as a Use After Free (CWE-416) issue that exists within the handling of Annotation objects. The specific flaw results from the lack of validating the existence of an object prior to performing operations on it. The vulnerability has received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, ZDI Advisory).

Successful exploitation of this vulnerability could result in arbitrary code execution in the context of the current user. The attacker could potentially gain the same rights and access as the compromised user process (Adobe Advisory, ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the victim must open a malicious file. As of the disclosure, there were no known exploits of this vulnerability in the wild (NVD, SecurityWeek).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Acrobat and Reader. The fix was included in Adobe's May 2024 security updates (Adobe Advisory).