CVE-2024-41869

HIGH

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contex...

Affects 8 products across 3 vendors.

CVSS 3.17.8
EPSS2.3%
Percentile83th
PatchPatched
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-416: Use After Free

Software references memory after it has been freed, leading to corruption, crashes, or code execution.

◆ AI Analysis — automated analysis, not human-reviewed

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are vulnerable to a Use After Free vulnerability, which could lead to arbitrary code execution if a malicious file is opened.

BSID: BS-2024-GLOBAL-202968-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-41869?
Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are vulnerable to a Use After Free vulnerability, which could lead to arbitrary code execution if a malicious file is opened.
What is the CVSS score for CVE-2024-41869?
CVE-2024-41869 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 2.3%.
Is CVE-2024-41869 actively exploited?
No confirmed active exploitation of CVE-2024-41869 as of 2026-05-30.
How do I remediate CVE-2024-41869?
Priority: HIGH. Advisory: https://helpx.adobe.com/security/products/acrobat/apsb24-70.html PSIRT: [email protected]
What systems are affected by CVE-2024-41869?
CVE-2024-41869 affects Adobe Acrobat Reader 2017, Acrobat Reader Dc, Acrobat 2017, Acrobat Reader, Acrobat, Acrobat Dc.
Vulnerability Details
CVE IDCVE-2024-41869
BSIDBS-2024-GLOBAL-202968-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2024-09-13
Last Modified2024-09-19
ICS Relevance0%
Weakness (CWE)
Use After Free
SourceNVD
Official Description

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is triggered by opening a specially crafted PDF file. An attacker could exploit this by sending a malicious PDF file to a victim, who must open it to be affected.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Adobe Acrobat Reader 2017 < 20.005.30680
Adobe Acrobat Reader Dc ≥ 24.003.0, < 24.003.20112
Adobe Acrobat 2017 < 20.005.30680 ≥ 24.001.0, < 24.001.30187
Adobe Acrobat Reader < 20.005.30680
Adobe Acrobat < 20.005.30680 ≥ 24.001.0, < 24.001.30187
Adobe Acrobat Dc ≥ 24.003.0, < 24.003.20112

Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Apple Macos, Microsoft Windows

Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 763 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash57e1027d6a3d8fd57b0c06238398c61c7501029eb7826b8a328b9c77b76a60582e53712fa60f7ce655a317df3296108e65b619b176f4686086f160b0bbc77e31
Related CVEs affecting Adobe
CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2012-1530 10.0 Heap-based buffer overflow in the XSLT engine in Adobe Reader and Acrobat 9.x... CVE-2012-0766 10.0 The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 ... CVE-2012-0772 10.0 An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 1... CVE-2026-48276 10.0 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestrict...
View all Adobe CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →