Vulnerability · Published Feb 23, 2021 · Assigned by adobe

CVE-2020-29075PDF Injection BlackHat Talk

High 7.1

In plain English

A high-severity improper input validation in Acrobat Reader DC from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)7.9%top 5.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure vulnerability, that could enable an attacker to get a DNS interaction and track if the user has opened or closed a PDF file when loaded from the filesystem without a prompt. User interaction is required to exploit this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Acrobat Reader DC	<= 2020.013.20066<= 2020.001.30010<= 2017.011.30180

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://helpx.adobe.com/security/products/acrobat/apsb20-75.html x_refsource_CONFIRM