Adobe patches 200+ flaws across product line
Adobe released December 2024 security updates addressing over 200 vulnerabilities across 19 products, including critical arbitrary code execution flaws in Acrobat, Creative Cloud apps, and Experience Manager.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Adobe has released comprehensive security updates addressing multiple vulnerabilities across its product portfolio, with the most severe flaws enabling arbitrary code execution in the context of the logged-on user. The December 2024 patch bundle covers 19 products including Acrobat Reader, Creative Cloud applications (Photoshop, Illustrator, Premiere Pro, After Effects), Adobe Experience Manager, and various Substance 3D tools. Vulnerability classes include use-after-free, out-of-bounds write, heap and stack-based buffer overflows, and numerous stored cross-site scripting (XSS) flaws in Experience Manager.
Adobe Experience Manager alone accounts for over 90 stored XSS vulnerabilities alongside improper input validation and authorization issues. Creative Cloud applications face memory corruption vulnerabilities including use-after-free conditions in After Effects, out-of-bounds write flaws in Illustrator and Media Encoder, and various buffer overflow conditions across multiple products. Adobe Connect contains multiple reflected XSS vulnerabilities, improper access control issues, and server-side request forgery (SSRF) flaws.
MS-ISAC reports no evidence of active exploitation in the wild at the time of advisory publication. Successful exploitation could allow attackers to execute arbitrary code, install programs, modify or delete data, or create new accounts with full user rights, though impact would vary based on victim account privileges. Adobe recommends immediate deployment of updates after appropriate testing, along with implementation of defense-in-depth controls including application allowlisting, exploit protection, and the principle of least privilege.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Applications
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command shells or scripting interpreters spawned from Adobe Reader/Acrobat or Creative Cloud applications, indicative of exploitation for client execution following a memory corruption or use-after-free vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Applications
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \Photoshop.exe
- \Illustrator.exe
- \AfterFX.exe
- \Premiere Pro.exe
- \AME.exe
- \Adobe Substance 3D Painter.exe
- \Adobe Substance 3D Designer.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_plugin_launcher:
CommandLine|contains:
- AdobeARM
- Creative Cloud\ACC\
condition: selection_parent and selection_child and not filter_plugin_launcher
id: 660cf7cb-12c3-550b-bb34-d00de5ff9d9e
status: experimental
author: Vorant
level: high
tags:
- attack.t1203
- attack.execution
falsepositives:
- Adobe update helper (AdobeARM) or Creative Cloud background service launching signed
maintenance scripts
- Third-party Acrobat plugins that legitimately shell out to helper utilities
Adobe Application Crash Followed by Unexpected Process Creation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an Adobe product (Reader, Acrobat, or Creative Cloud app) writing to or loading from unusual locations shortly after launching a document/media file, which can indicate exploitation of a memory-corruption vulnerability leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Application Loading Executable Module from Temp or User Directory
logsource:
category: image_load
product: windows
detection:
selection_proc:
Image|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \Photoshop.exe
- \Illustrator.exe
- \AfterFX.exe
selection_path:
ImageLoaded|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Downloads\
filter_known:
ImageLoaded|endswith:
- .dll
ImageLoaded|contains:
- \Adobe\
condition: selection_proc and selection_path and not filter_known
id: d446c530-028f-544a-9924-3d923662c451
status: experimental
author: Vorant
level: medium
tags:
- attack.t1203
falsepositives:
- Legitimate plugin or extension installed by the user in a temp/download path
- Enterprise software packaging tools that stage Adobe plugins from temp directories
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2024-134
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs