CVE-2024-39420

Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS v3.0 7.0 HIGH

7.0^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/acrobat/apsb24-70.html

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:acrobat:::::classic:::*
	cpe:2.3:a:adobe:acrobat:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

13 Sep 2024, 09:15

Type	Values Removed	Values Added
Summary	Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when the state of a resource changes between its check-time and use-time, allowing an attacker to manipulate the resource. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References	~~{'url': 'https://helpx.adobe.com/security/products/acrobat/apsb24-57.html', 'name': 'https://helpx.adobe.com/security/products/acrobat/apsb24-57.html', 'tags': ['Vendor Advisory'], 'refsource': ''}~~	() https://helpx.adobe.com/security/products/acrobat/apsb24-70.html -

15 Aug 2024, 17:26

Type	Values Removed	Values Added
First Time		Apple Apple macos Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Dc Adobe Adobe acrobat Reader Microsoft Microsoft windows
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 7.0
References	~~() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html -~~	() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 7.0
References	~~() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html -~~	() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html - Vendor Advisory
CPE		cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat_reader:::::classic:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
First Time		Apple Apple macos Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Dc Adobe Adobe acrobat Reader Microsoft Microsoft windows
CPE		cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat_reader:::::classic:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*

14 Aug 2024, 17:49

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.0~~	v2 : unknown v3 : 7.8
CPE	cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat_reader:::::classic:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*

14 Aug 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-14 15:15

Updated : 2024-09-16 13:15

NVD link : CVE-2024-39420

Mitre link : CVE-2024-39420

JSON object : View

Products Affected

adobe

acrobat_dc
acrobat
acrobat_reader
acrobat_reader_dc

apple

macos

microsoft

windows

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

7.0 /10