CVE-2020-9715

Adobe Acrobat and Reader

Published 19 Aug 2020 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Apr 2026, with a remediation deadline of 27 Apr 2026 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

References

blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/ · Exploit, Patch, Third Party Advisory
helpx.adobe.com/security/products/acrobat/apsb20-48.html · Vendor Advisory
www.zerodayinitiative.com/advisories/ZDI-20-991/ · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715 · US Government Resource