Adobe patches 200+ flaws across product line
Adobe released December 2024 security updates addressing over 200 vulnerabilities across 19 products, including critical arbitrary code execution flaws in Acrobat, Creative Cloud apps, and Experience Manager.
Adobe has released comprehensive security updates addressing multiple vulnerabilities across its product portfolio, with the most severe flaws enabling arbitrary code execution in the context of the logged-on user. The December 2024 patch bundle covers 19 products including Acrobat Reader, Creative Cloud applications (Photoshop, Illustrator, Premiere Pro, After Effects), Adobe Experience Manager, and various Substance 3D tools. Vulnerability classes include use-after-free, out-of-bounds write, heap and stack-based buffer overflows, and numerous stored cross-site scripting (XSS) flaws in Experience Manager.
Adobe Experience Manager alone accounts for over 90 stored XSS vulnerabilities alongside improper input validation and authorization issues. Creative Cloud applications face memory corruption vulnerabilities including use-after-free conditions in After Effects, out-of-bounds write flaws in Illustrator and Media Encoder, and various buffer overflow conditions across multiple products. Adobe Connect contains multiple reflected XSS vulnerabilities, improper access control issues, and server-side request forgery (SSRF) flaws.
MS-ISAC reports no evidence of active exploitation in the wild at the time of advisory publication. Successful exploitation could allow attackers to execute arbitrary code, install programs, modify or delete data, or create new accounts with full user rights, though impact would vary based on victim account privileges. Adobe recommends immediate deployment of updates after appropriate testing, along with implementation of defense-in-depth controls including application allowlisting, exploit protection, and the principle of least privilege.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Applications
Detects command shells or scripting interpreters spawned from Adobe Reader/Acrobat or Creative Cloud applications, indicative of exploitation for client execution following a memory corruption or use-after-free vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Applications
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \Photoshop.exe
- \Illustrator.exe
- \AfterFX.exe
- \Premiere Pro.exe
- \AME.exe
- \Adobe Substance 3D Painter.exe
- \Adobe Substance 3D Designer.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_plugin_launcher:
CommandLine|contains:
- AdobeARM
- Creative Cloud\ACC\
condition: selection_parent and selection_child and not filter_plugin_launcher
falsepositives:
- Adobe update helper (AdobeARM) or Creative Cloud background service launching
signed maintenance scripts
- Third-party Acrobat plugins that legitimately shell out to helper utilities
level: high
tags:
- attack.t1203
- attack.execution
id: 660cf7cb-12c3-550b-bb34-d00de5ff9d9e
status: experimental
author: Vorant
Adobe Application Crash Followed by Unexpected Process Creation
Detects an Adobe product (Reader, Acrobat, or Creative Cloud app) writing to or loading from unusual locations shortly after launching a document/media file, which can indicate exploitation of a memory-corruption vulnerability leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Loading Executable Module from Temp or User Directory
logsource:
category: image_load
product: windows
detection:
selection_proc:
Image|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \Photoshop.exe
- \Illustrator.exe
- \AfterFX.exe
selection_path:
ImageLoaded|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Downloads\
filter_known:
ImageLoaded|endswith:
- .dll
ImageLoaded|contains:
- \Adobe\
condition: selection_proc and selection_path and not filter_known
falsepositives:
- Legitimate plugin or extension installed by the user in a temp/download path
- Enterprise software packaging tools that stage Adobe plugins from temp directories
level: medium
tags:
- attack.t1203
- attack.defense_evasion
id: d446c530-028f-544a-9924-3d923662c451
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2024-134
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free