CVE-2024-39422 - Vulnerability Details

Vendors	Products
Adobe	Acrobat Acrobat Dc Acrobat Reader Acrobat Reader Dc
Apple	Macos
Microsoft	Windows

Link	Providers
https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Microsoft Microsoft windows
CPEs		cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:a:adobe:acrobat_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat_reader:::::classic:::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Microsoft Microsoft windows

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc
CPEs		cpe:2.3:a:adobe:acrobat:::::::: cpe:2.3:a:adobe:acrobat::::::macos::* cpe:2.3:a:adobe:acrobat::::::windows::* cpe:2.3:a:adobe:acrobat_dc::::::macos::* cpe:2.3:a:adobe:acrobat_dc::::::windows::* cpe:2.3:a:adobe:acrobat_reader::::::macos::* cpe:2.3:a:adobe:acrobat_reader::::::windows::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:macos:: cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:windows::
Vendors & Products		Adobe Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title		ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC
Weaknesses		CWE-416
References		https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39422", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2024-06-24T20:32:06.595Z", "datePublished": "2024-08-14T15:07:31.068Z", "dateUpdated": "2024-08-15T03:55:53.237Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Acrobat Reader", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "24.001.30123", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2024-08-13T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "NOT_DEFINED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "Use After Free (CWE-416)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2024-08-14T15:07:31.068Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC"}, "adp": [{"affected": [{"vendor": "adobe", "product": "acrobat_dc", "cpes": ["cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.002.20991", "versionType": "semver"}]}, {"vendor": "adobe", "product": "acrobat_dc", "cpes": ["cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.002.20964", "versionType": "semver"}]}, {"vendor": "adobe", "product": "acrobat", "cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.001.30123", "versionType": "custom"}]}, {"vendor": "adobe", "product": "acrobat", "cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.001.30123", "versionType": "semver"}, {"version": "20.0", "status": "affected", "lessThanOrEqual": "20.005.30636", "versionType": "semver"}]}, {"vendor": "adobe", "product": "acrobat", "cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.001.30123", "versionType": "semver"}, {"version": "20.0", "status": "affected", "lessThanOrEqual": "20.005.30635", "versionType": "semver"}]}, {"vendor": "adobe", "product": "acrobat_reader", "cpes": ["cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "20.005.30636", "versionType": "custom"}]}, {"vendor": "adobe", "product": "acrobat_reader", "cpes": ["cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "20.005.30635", "versionType": "custom"}]}, {"vendor": "adobe", "product": "acrobat_reader_dc", "cpes": ["cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.002.20964", "versionType": "semver"}]}, {"vendor": "adobe", "product": "acrobat_reader_dc", "cpes": ["cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.002.20991", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-39422"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T03:55:53.237Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-39422 (string)

assignerOrgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

state : PUBLISHED (string)

assignerShortName : adobe (string)

dateReserved : 2024-06-24T20:32:06.595Z (string)

datePublished : 2024-08-14T15:07:31.068Z (string)

dateUpdated : 2024-08-15T03:55:53.237Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : affected (string)

product : Acrobat Reader (string)

vendor : Adobe (string)

versions : [ »

0 : { »

lessThanOrEqual : 24.001.30123 (string)

status : affected (string)

version : 0 (string)

versionType : semver (string)

}

]

}

]

datePublic : 2024-08-13T17:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

confidentialityRequirement : NOT_DEFINED (string)

environmentalScore : 7.8 (number)

environmentalSeverity : HIGH (string)

exploitCodeMaturity : NOT_DEFINED (string)

integrityImpact : HIGH (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : LOW (string)

modifiedAttackVector : LOCAL (string)

modifiedAvailabilityImpact : HIGH (string)

modifiedConfidentialityImpact : HIGH (string)

modifiedIntegrityImpact : HIGH (string)

modifiedPrivilegesRequired : NONE (string)

modifiedScope : NOT_DEFINED (string)

modifiedUserInteraction : REQUIRED (string)

privilegesRequired : NONE (string)

remediationLevel : NOT_DEFINED (string)

reportConfidence : NOT_DEFINED (string)

scope : UNCHANGED (string)

temporalScore : 7.8 (number)

temporalSeverity : HIGH (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-416 (string)

description : Use After Free (CWE-416) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

shortName : adobe (string)

dateUpdated : 2024-08-14T15:07:31.068Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb24-57.html (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : adobe (string)

product : acrobat_dc (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.002.20991 (string)

versionType : semver (string)

}

]

}

1 : { »

vendor : adobe (string)

product : acrobat_dc (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.002.20964 (string)

versionType : semver (string)

}

]

}

2 : { »

vendor : adobe (string)

product : acrobat (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.001.30123 (string)

versionType : custom (string)

}

]

}

3 : { »

vendor : adobe (string)

product : acrobat (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.001.30123 (string)

versionType : semver (string)

}

1 : { »

version : 20.0 (string)

status : affected (string)

lessThanOrEqual : 20.005.30636 (string)

versionType : semver (string)

}

]

}

4 : { »

vendor : adobe (string)

product : acrobat (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.001.30123 (string)

versionType : semver (string)

}

1 : { »

version : 20.0 (string)

status : affected (string)

lessThanOrEqual : 20.005.30635 (string)

versionType : semver (string)

}

]

}

5 : { »

vendor : adobe (string)

product : acrobat_reader (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 20.005.30636 (string)

versionType : custom (string)

}

]

}

6 : { »

vendor : adobe (string)

product : acrobat_reader (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 20.005.30635 (string)

versionType : custom (string)

}

]

}

7 : { »

vendor : adobe (string)

product : acrobat_reader_dc (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.002.20964 (string)

versionType : semver (string)

}

]

}

8 : { »

vendor : adobe (string)

product : acrobat_reader_dc (string)

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 24.002.20991 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-14T00:00:00+00:00 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

id : CVE-2024-39422 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-15T03:55:53.237Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39422", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-14T15:52:07.707553Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"], "vendor": "adobe", "product": "acrobat_dc", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.002.20991"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"], "vendor": "adobe", "product": "acrobat_dc", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.002.20964"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"], "vendor": "adobe", "product": "acrobat", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "24.001.30123"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"], "vendor": "adobe", "product": "acrobat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.001.30123"}, {"status": "affected", "version": "20.0", "versionType": "semver", "lessThanOrEqual": "20.005.30636"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"], "vendor": "adobe", "product": "acrobat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.001.30123"}, {"status": "affected", "version": "20.0", "versionType": "semver", "lessThanOrEqual": "20.005.30635"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"], "vendor": "adobe", "product": "acrobat_reader", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "20.005.30636"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"], "vendor": "adobe", "product": "acrobat_reader", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "20.005.30635"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"], "vendor": "adobe", "product": "acrobat_reader_dc", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.002.20964"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"], "vendor": "adobe", "product": "acrobat_reader_dc", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.002.20991"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T15:54:55.932Z"}}], "cna": {"title": "ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modifiedScope": "NOT_DEFINED", "temporalScore": 7.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 7.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Acrobat Reader", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "24.001.30123"}], "defaultStatus": "affected"}], "datePublic": "2024-08-13T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free (CWE-416)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2024-08-14T15:07:31.068Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39422", "state": "PUBLISHED", "dateUpdated": "2024-08-14T15:55:27.119Z", "dateReserved": "2024-06-24T20:32:06.595Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2024-08-14T15:07:31.068Z", "assignerShortName": "adobe"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-39422 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-14T15:52:07.707553Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* (string)

]

vendor : adobe (string)

product : acrobat_dc (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.002.20991 (string)

}

]

defaultStatus : affected (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* (string)

]

vendor : adobe (string)

product : acrobat_dc (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.002.20964 (string)

}

]

defaultStatus : affected (string)

}

2 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* (string)

]

vendor : adobe (string)

product : acrobat (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 24.001.30123 (string)

}

]

defaultStatus : affected (string)

}

3 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* (string)

]

vendor : adobe (string)

product : acrobat (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.001.30123 (string)

}

1 : { »

status : affected (string)

version : 20.0 (string)

versionType : semver (string)

lessThanOrEqual : 20.005.30636 (string)

}

]

defaultStatus : affected (string)

}

4 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* (string)

]

vendor : adobe (string)

product : acrobat (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.001.30123 (string)

}

1 : { »

status : affected (string)

version : 20.0 (string)

versionType : semver (string)

lessThanOrEqual : 20.005.30635 (string)

}

]

defaultStatus : affected (string)

}

5 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* (string)

]

vendor : adobe (string)

product : acrobat_reader (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 20.005.30636 (string)

}

]

defaultStatus : affected (string)

}

6 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* (string)

]

vendor : adobe (string)

product : acrobat_reader (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 20.005.30635 (string)

}

]

defaultStatus : affected (string)

}

7 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* (string)

]

vendor : adobe (string)

product : acrobat_reader_dc (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.002.20964 (string)

}

]

defaultStatus : affected (string)

}

8 : { »

cpes : [ »

0 : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* (string)

]

vendor : adobe (string)

product : acrobat_reader_dc (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.002.20991 (string)

}

]

defaultStatus : affected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-14T15:54:55.932Z (string)

}

]

cna : { »

title : ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC (string)

source : { »

discovery : EXTERNAL (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

modifiedScope : NOT_DEFINED (string)

temporalScore : 7.8 (number)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

remediationLevel : NOT_DEFINED (string)

reportConfidence : NOT_DEFINED (string)

temporalSeverity : HIGH (string)

availabilityImpact : HIGH (string)

environmentalScore : 7.8 (number)

privilegesRequired : NONE (string)

exploitCodeMaturity : NOT_DEFINED (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackVector : LOCAL (string)

confidentialityImpact : HIGH (string)

environmentalSeverity : HIGH (string)

availabilityRequirement : NOT_DEFINED (string)

modifiedIntegrityImpact : HIGH (string)

modifiedUserInteraction : REQUIRED (string)

modifiedAttackComplexity : LOW (string)

confidentialityRequirement : NOT_DEFINED (string)

modifiedAvailabilityImpact : HIGH (string)

modifiedPrivilegesRequired : NONE (string)

modifiedConfidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Adobe (string)

product : Acrobat Reader (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : semver (string)

lessThanOrEqual : 24.001.30123 (string)

}

]

defaultStatus : affected (string)

}

]

datePublic : 2024-08-13T17:00:00.000Z (string)

references : [ »

0 : { »

url : https://helpx.adobe.com/security/products/acrobat/apsb24-57.html (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-416 (string)

description : Use After Free (CWE-416) (string)

}

]

}

]

providerMetadata : { »

orgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

shortName : adobe (string)

dateUpdated : 2024-08-14T15:07:31.068Z (string)

}

cveMetadata : { »

cveId : CVE-2024-39422 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-14T15:55:27.119Z (string)

dateReserved : 2024-06-24T20:32:06.595Z (string)

assignerOrgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

datePublished : 2024-08-14T15:07:31.068Z (string)

assignerShortName : adobe (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*", "matchCriteriaId": "B9311FEC-D9CC-421C-8E5E-8131E460FC42", "versionEndExcluding": "20.005.30655", "versionStartIncluding": "20.001.30005", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*", "matchCriteriaId": "1A09E4B8-DB3B-45EC-B441-2C9549D299B1", "versionEndExcluding": "24.001.30159", "versionStartIncluding": "24.001.20604", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*", "matchCriteriaId": "D555A6CB-9EDF-4CA2-B8E5-04A9D212FD8B", "versionEndExcluding": "24.002.21005", "versionStartIncluding": "15.008.20082", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*", "matchCriteriaId": "883444C8-35EB-4BDF-A14C-C4C5BF97239A", "versionEndExcluding": "20.005.30655", "versionStartIncluding": "20.001.3005", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*", "matchCriteriaId": "9CE03784-4780-4313-A27A-37B265BF3F9D", "versionEndExcluding": "24.002.21005", "versionStartIncluding": "15.008.20082", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "id": "CVE-2024-39422", "lastModified": "2024-08-15T17:25:54.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Primary"}]}, "published": "2024-08-14T15:15:25.187", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "psirt@adobe.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : B9311FEC-D9CC-421C-8E5E-8131E460FC42 (string)

versionEndExcluding : 20.005.30655 (string)

versionStartIncluding : 20.001.30005 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : 1A09E4B8-DB3B-45EC-B441-2C9549D299B1 (string)

versionEndExcluding : 24.001.30159 (string)

versionStartIncluding : 24.001.20604 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* (string)

matchCriteriaId : D555A6CB-9EDF-4CA2-B8E5-04A9D212FD8B (string)

versionEndExcluding : 24.002.21005 (string)

versionStartIncluding : 15.008.20082 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* (string)

matchCriteriaId : 883444C8-35EB-4BDF-A14C-C4C5BF97239A (string)

versionEndExcluding : 20.005.30655 (string)

versionStartIncluding : 20.001.3005 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* (string)

matchCriteriaId : 9CE03784-4780-4313-A27A-37B265BF3F9D (string)

versionEndExcluding : 24.002.21005 (string)

versionStartIncluding : 15.008.20082 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 387021A0-AF36-463C-A605-32EA7DAC172E (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2572D17-1DE6-457B-99CC-64AFD54487EA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. (string)

}

]

id : CVE-2024-39422 (string)

lastModified : 2024-08-15T17:25:54.750 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : psirt@adobe.com (string)

type : Primary (string)

}

]

}

published : 2024-08-14T15:15:25.187 (string)

references : [ »

0 : { »

source : psirt@adobe.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/acrobat/apsb24-57.html (string)

}

]

sourceIdentifier : psirt@adobe.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-416 (string)

}

]

source : psirt@adobe.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object