Cyber Posture

CVE-2025-27161

High

Published: 11 March 2025

Published
11 March 2025
Modified
28 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0012 29.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27161 is an out-of-bounds read vulnerability (CWE-125) affecting Adobe Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428, and earlier. The issue arises when parsing a crafted file, which could result in a read past the end of an allocated memory structure. Published on 2025-03-11, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by an attacker who tricks a victim into opening a malicious file, requiring local access and user interaction but no special privileges. Successful exploitation allows arbitrary code execution in the context of the current user, potentially leading to full compromise of the victim's system with high impacts on confidentiality, integrity, and availability.

Adobe's security bulletin APSB25-14 provides details on mitigation and available patches: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html.

Details

CWE(s)
CWE-125

Affected Products

adobe
acrobat
20.001.30002 — 20.005.30763 · 24.0.0 — 24.001.30235
adobe
acrobat dc
15.008.20082 — 25.001.20432
adobe
acrobat reader
20.001.30002 — 20.005.30763
adobe
acrobat reader dc
15.008.20082 — 25.001.20432

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The out-of-bounds read in Adobe Acrobat Reader enables arbitrary code execution upon opening a crafted malicious file, directly mapping to client-side exploitation (T1203) and user execution of a malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References