Multiple Adobe products vulnerable to arbitrary code execution

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adobe released patches for critical vulnerabilities across Acrobat, After Effects, Premiere Pro, and other products allowing arbitrary code execution; no active exploitation reported.

Sourcecisecurity.org — open the original

Adobe disclosed multiple vulnerabilities across nine products, with the most severe allowing arbitrary code execution in the context of the logged-on user. Affected products include Acrobat and Reader, After Effects, Premiere Pro, Commerce (and Magento Open Source), Substance 3D Viewer, Experience Manager, Dreamweaver, Substance 3D Modeler, and ColdFusion. The vulnerabilities span various weakness classes including use-after-free, buffer overflows, out-of-bounds access, improper input validation, CSRF, SSRF, and path traversal. While no active in-the-wild exploitation has been reported, successful exploitation could allow an attacker to install programs, modify or delete data, or create administrative accounts depending on the compromised user's privilege level.

The advisory provides extensive affected version information across multiple product lines and release tracks. Adobe has released stable channel updates to address these issues. Organizations should prioritize patching based on their deployed products and the severity of the vulnerability classes affecting each. Defenders should apply patches immediately after testing, implement application allowlisting and exploit protection features, enforce least-privilege principles, and maintain vulnerability management processes.

title: Adobe Acrobat or Reader Spawning Script Interpreter or LOLBin
description: Detects Adobe Acrobat/Reader spawning command interpreters, script hosts
  or living-off-the-land binaries. After exploitation of a memory-corruption bug in
  the PDF renderer, shellcode commonly launches these to stage a payload in the context
  of the logged-on user.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
  condition: selection
falsepositives:
- PDF workflows or plug-ins that deliberately shell out to cmd.exe, for example some
  enterprise document-management integrations
- Adobe installer or repair actions that launch msiexec.exe from Acrobat
level: high
id: 095d909b-647b-5e4d-ab4d-d61e53d1a4a6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083

title: Adobe Acrobat or Reader Launching Executable From User-Writable Path
description: Detects Acrobat/Reader creating a child process whose binary resides
  in a user-writable staging directory (Temp, Users\Public, Downloads). This pattern
  follows exploitation of a document-parsing flaw that drops and executes a second-stage
  payload.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    Image|contains:
    - \AppData\Local\Temp\
    - \Users\Public\
    - \Downloads\
  filter_adobe:
    Image|contains:
    - \Adobe\
    - \Acrobat\
  condition: selection and not filter_adobe
falsepositives:
- Acrobat opening an attachment that launches an installer extracted to Temp
- Users launching a downloaded helper tool from a PDF via an embedded launch action
level: medium
id: 059120ac-c303-5cc5-9e1b-bef1cae8b56c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-083

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.