CVE-2024-45112

Published: Sep 13, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: psirt@adobe.com (Secondary)

Description

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when a resource is accessed using a type that is not compatible with the actual object type, leading to a logic error that an attacker could exploit. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected (5)

Products: Adobe: Acrobat, Acrobat Dc, Acrobat Reader, Acrobat Reader Dc

4 products

Configuration A

5 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Adobe Acrobat	Before 20.005.30680
Adobe Acrobat	From 24.001.0 to 24.001.30187
Adobe Acrobat Dc	From 24.003.0 to 24.003.20112
Adobe Acrobat Reader	Before 20.005.30680
Adobe Acrobat Reader Dc	From 24.003.0 to 24.003.20112

Running on/with	Platform Versions
Apple Macos	All versions
Microsoft Windows	All versions

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (1)

https://helpx.adobe.com/security/products/acrobat/apsb24-70.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.