Cyber Posture

CVE-2025-27162

High

Published: 11 March 2025

Published
11 March 2025
Modified
28 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0012 29.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27162 is an Access of Uninitialized Pointer vulnerability (CWE-824) affecting Adobe Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428, and earlier. Published on 2025-03-11, this flaw could result in arbitrary code execution in the context of the current user.

Exploitation requires user interaction, as a victim must open a malicious file. An attacker needs local access (AV:L) with no privileges (PR:N) and can exploit it with low attack complexity (AC:L), leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the current scope (S:U). The vulnerability has a CVSS v3.1 base score of 7.8.

Adobe Security Bulletin APSB25-14 at https://helpx.adobe.com/security/products/acrobat/apsb25-14.html provides details on mitigation.

Details

CWE(s)
CWE-824

Affected Products

adobe
acrobat
20.001.30002 — 20.005.30763 · 24.0.0 — 24.001.30235
adobe
acrobat dc
15.008.20082 — 25.001.20432
adobe
acrobat reader
20.001.30002 — 20.005.30763
adobe
acrobat reader dc
15.008.20082 — 25.001.20432

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The vulnerability is a client-side RCE in Adobe Acrobat Reader triggered by opening a malicious file, directly enabling T1203 (Exploitation for Client Execution) via T1204.002 (User Execution: Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References