{"id":"CVE-2020-24435","published":"2020-11-05T19:32:12Z","modified":"2024-09-17T04:04:27Z","title":"Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution","vendor":"Adobe","product":"Acrobat Reader","tier":"tail","description":{"text":"Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file in Acrobat Reader.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.52718,"percentile":0.98966,"provenance":"source"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb20-67.html","tags":["x_refsource_MISC"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1157","tags":["x_refsource_MISC"]}],"priority":{"score":25.3,"factors":[{"name":"EPSS percentile","points":19.79},{"name":"CVSS severity","points":5.46}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Acrobat Reader","versions":[">= unspecified, <= 2017.011.30175",">= unspecified, <= 2020.012.20048",">= unspecified, <= 2020.001.30005",">= unspecified, <= None"]}],"euvd":{"id":"EUVD-2020-17155","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-adobe-acrobat-reader-cwe-122"}}