CVE-2025-27162
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-27162 is an Access of Uninitialized Pointer vulnerability (CWE-824) affecting Adobe Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428, and earlier. Published on 2025-03-11, this flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. An attacker needs local access (AV:L) with no privileges (PR:N) and can exploit it with low attack complexity (AC:L), leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the current scope (S:U). The vulnerability has a CVSS v3.1 base score of 7.8.
Adobe Security Bulletin APSB25-14 at https://helpx.adobe.com/security/products/acrobat/apsb25-14.html provides details on mitigation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a client-side RCE in Adobe Acrobat Reader triggered by opening a malicious file, directly enabling T1203 (Exploitation for Client Execution) via T1204.002 (User Execution: Malicious File).