CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
Overview
Adobe Acrobat and Reader contain a use-after-free flaw in the EScript.api module's JavaScript engine, affecting the Continuous, Classic 2017, Classic 2020, and Classic 2015 tracks on both Windows and macOS. An attacker who can persuade a user to open a crafted PDF file can trigger memory corruption and execute arbitrary code in the context of the current user. All versions through 2020.009.20074, 2020.001.30002, 2017.011.30171, and 2015.006.30523 are affected.
Vulnerability details
The flaw resides in how EScript.api manages a cache of data ESObjects, which represent embedded files and data streams in PDF documents. The cache uses a key composed of a document pointer and an object name string, but insertion preserves the original ANSI or Unicode encoding while deletion always constructs the key in Unicode. Because ANSI-named entries are never matched during deletion, their cache slots retain pointers to freed memory indefinitely. This is a classic use-after-free condition under CWE-416: the object is released but the reference persists, and any subsequent access through that stale pointer operates on reclaimed or corrupted memory.
An attacker delivers a crafted PDF containing embedded JavaScript that manipulates data ESObjects with ANSI-encoded names. The script deletes an object (for example, via this.dataObjects[0]) and then immediately accesses the same name again. The cache returns the dangling pointer to the freed ESObject rather than allocating a new one, triggering the use-after-free. This gives the attacker the ability to execute arbitrary code in the context of the user running Acrobat or Reader. User interaction is required: the victim must open the malicious file.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Audit installed versions of Adobe Acrobat and Reader across the fleet. Any instance at or below 2020.009.20074, 2017.011.30171, or 2015.006.30523 is unpatched and represents active exposure.
- Review application crash logs and Windows Error Reporting entries for AcroRd32.exe or Acrobat.exe faults inside EScript.api, which may indicate failed or in-progress exploitation attempts against the ESObject cache.
Remediation
Additional hardening
- Update Acrobat DC and Reader DC to 2020.012.20041 or later, Acrobat/Reader 2017 to 2017.011.30175 or later, and Acrobat/Reader 2015 to 2015.006.30527 or later. See the vendor advisory in References for full version details.
- Disable JavaScript execution in Adobe Acrobat and Reader via Edit > Preferences > JavaScript by unchecking 'Enable Acrobat JavaScript'. This removes the attack surface entirely, since exploitation requires embedded JavaScript to manipulate ESObjects.
- Configure email gateways and web proxies to inspect or quarantine PDF attachments from untrusted sources before delivery to end users, reducing the likelihood that a crafted file reaches a vulnerable installation.
- Apply Protected Mode and Protected View settings in Acrobat and Reader to sandbox document rendering, limiting the impact of a successful exploitation attempt to the sandboxed process.
Key dates
References
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-9715
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715
Frequently asked questions
Does CVE-2020-9715 affect my FedRAMP authorization?
If Adobe Acrobat runs inside your authorization boundary, yes. CVE-2020-9715 is listed in CISA's Known Exploited Vulnerabilities catalog, and its remediation deadline of April 27, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2020-9715?
Knox does not patch your software. Remediating Adobe Acrobat is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours. Managing your compliance posture while you do it is not something you handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a case like CVE-2020-9715, exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into where the boundary stands.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2020-9715's remediation deadline of April 27, 2026 has passed. What happens now?
If CVE-2020-9715 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization in good standing and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
