Adobe patches critical Acrobat Reader flaws
Adobe released security updates for Acrobat and Reader on August 14, 2024, addressing vulnerabilities that could allow arbitrary code execution or denial of service.
On August 14, 2024, Adobe published security updates for Adobe Acrobat and Reader addressing multiple vulnerabilities. Exploitation of these flaws could result in application crashes or allow attackers to gain control of affected systems, leading to various forms of compromise. The Japan Information-Technology Promotion Agency (IPA) has classified these vulnerabilities as high-impact and urges immediate patching.
Affected versions include Acrobat and Reader 24.002.20991 and earlier on Windows, 24.002.20964 and earlier on macOS, as well as older continuous and classic track releases down to version 20.005.30636 on Windows and 20.005.30635 on macOS. Users are advised to update to the latest versions provided by Adobe.
The advisory emphasizes the severity of potential attacks and recommends prompt application of security updates to mitigate risk. No specific exploitation details or threat actor attribution is provided in the notice.
Detection guidance
Suspicious Child Process Spawned from Adobe Acrobat/Reader
Detects Adobe Acrobat or Acrobat Reader spawning command interpreters or scripting engines, a common post-exploitation behaviour following successful exploitation of PDF parsing vulnerabilities such as those patched in the August 2024 Adobe advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Adobe Acrobat/Reader
id: 741e9f68-a03c-58bf-b294-6b2c3165fa34
status: experimental
description: 'Detects Adobe Acrobat or Acrobat Reader (Acrobat.exe, AcroRd32.exe)
spawning a command interpreter,
scripting host, or other unusual child process. This behaviour is consistent with
successful
exploitation of a memory corruption or logic flaw in the PDF renderer leading to
arbitrary code
execution, such as the vulnerabilities patched by Adobe in August 2024.
'
references:
- https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \Acrobat_sl.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_updater:
CommandLine|contains:
- AdobeARM.exe
- Adobe Acrobat Update Service
- \AdobeUpdater\
condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Adobe auto-update or repair processes launching helper binaries via legitimate update
mechanisms
- Enterprise software packaging or macro tools that legitimately invoke command interpreters
from Acrobat plugins
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/0814-adobereader.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free