# Adobe patches critical Acrobat Reader flaws

Published: 2024-08-13 · Severity: high
Canonical: https://vorant.io/reports/d96f3788-ce65-48b8-8ab3-888ea98be1a9/adobe-patches-critical-acrobat-reader-flaws

> Adobe released security updates for Acrobat and Reader on August 14, 2024, addressing vulnerabilities that could allow arbitrary code execution or denial of service.

On August 14, 2024, Adobe published security updates for Adobe Acrobat and Reader addressing multiple vulnerabilities. Exploitation of these flaws could result in application crashes or allow attackers to gain control of affected systems, leading to various forms of compromise. The Japan Information-Technology Promotion Agency (IPA) has classified these vulnerabilities as high-impact and urges immediate patching.

Affected versions include Acrobat and Reader 24.002.20991 and earlier on Windows, 24.002.20964 and earlier on macOS, as well as older continuous and classic track releases down to version 20.005.30636 on Windows and 20.005.30635 on macOS. Users are advised to update to the latest versions provided by Adobe.

The advisory emphasizes the severity of potential attacks and recommends prompt application of security updates to mitigate risk. No specific exploitation details or threat actor attribution is provided in the notice.

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Adobe Acrobat/Reader

ATT&CK: T1203

Detects Adobe Acrobat or Acrobat Reader spawning command interpreters or scripting engines, a common post-exploitation behaviour following successful exploitation of PDF parsing vulnerabilities such as those patched in the August 2024 Adobe advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Adobe Acrobat/Reader
id: 741e9f68-a03c-58bf-b294-6b2c3165fa34
status: experimental
description: 'Detects Adobe Acrobat or Acrobat Reader (Acrobat.exe, AcroRd32.exe)
  spawning a command interpreter,

  scripting host, or other unusual child process. This behaviour is consistent with
  successful

  exploitation of a memory corruption or logic flaw in the PDF renderer leading to
  arbitrary code

  execution, such as the vulnerabilities patched by Adobe in August 2024.

  '
references:
- https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \Acrobat_sl.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_updater:
    CommandLine|contains:
    - AdobeARM.exe
    - Adobe Acrobat Update Service
    - \AdobeUpdater\
  condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Adobe auto-update or repair processes launching helper binaries via legitimate update
  mechanisms
- Enterprise software packaging or macro tools that legitimately invoke command interpreters
  from Acrobat plugins
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/0814-adobereader.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d96f3788-ce65-48b8-8ab3-888ea98be1a9/adobe-patches-critical-acrobat-reader-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup