CVE-2025-64785
BaseFortify
Publication date: 2025-12-09
Last updated on: 2026-04-28
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | acrobat_dc | to 25.001.20997 (inc) |
| adobe | acrobat_reader_dc | to 25.001.20997 (inc) |
| adobe | acrobat_reader | 24.001.30273 |
| adobe | acrobat_reader | 25.001.20982 |
| adobe | acrobat_reader | 20.005.30793 |
| adobe | acrobat_reader | 24.001.30264 |
| adobe | acrobat_reader | 20.005.30803 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Acrobat Reader to a version later than 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, or 20.005.30803. Avoid using untrusted search paths for critical resources and ensure that the application does not execute programs from locations that can be modified by attackers.
Can you explain this vulnerability to me?
This vulnerability is an Untrusted Search Path issue in certain versions of Acrobat Reader. It allows attackers to execute arbitrary code by modifying the search path that the application uses to locate critical resources. When Acrobat Reader searches for programs or resources, an attacker can insert a malicious program in the search path, causing the application to execute the malicious code instead of the intended resource. This can happen without any user interaction.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute arbitrary code with the privileges of the current user. This means an attacker could potentially take control of the affected system, access sensitive information, install malware, or perform other malicious actions without the user's knowledge or consent.