CVE-2020-9715: Adobe Acrobat use-after-free in PDF parsing

CVE-2020-9715 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-04-13

Adobe Acrobat and Reader, widely used applications for viewing and managing PDF documents, contain a critical security flaw. An attacker could exploit this vulnerability to take control of a user's computer if the user is tricked into opening a specially crafted PDF file. This vulnerability has been observed being used in active attacks in the wild.

Technologies: Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader Dc, Adobe AIR, Adobe Flash Player, Adobe Reader. Vendors: Adobe.

Quick answers

Is CVE-2020-9715 exploited in the wild?
Yes. CVE-2020-9715 is known to be exploited in the wild, first recorded on 13 April 2026. Treat it as urgent.
How severe is CVE-2020-9715?
Critical severity, with a CVSS score of 7.8, published 13 April 2026.
Which products and versions are affected?
Adobe Acrobat Dc 20.009.20074 and earlier, 2020.001.30002, 17.011.30171 and earlier, 15.006.30523 and earlier; Adobe Acrobat Reader Dc 20.009.20074 and earlier, 2020.001.30002, 17.011.30171 and earlier, 15.006.30523 and earlier.
Is there a fix for CVE-2020-9715?
A patch was published on 2020-08-11: Adobe released security bulletin APSB20-48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-9715 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-9715?
Check whether you run Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader Dc or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (CWE-416) vulnerability exists in Adobe Acrobat and Reader across multiple versions (Continuous and Classic tracks). The flaw is triggered when the application attempts to access memory that has already been deallocated, typically during the processing of malformed PDF content. While the attack vector is classified as local because it requires the user to open a file, it can be delivered via remote means such as email or web downloads. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Adobe has released patches to address this issue.

Affected products

  • Adobe Acrobat DC 20.009.20074 and earlier, 2020.001.30002, 17.011.30171 and earlier, 15.006.30523 and earlier
  • Adobe Acrobat Reader DC 20.009.20074 and earlier, 2020.001.30002, 17.011.30171 and earlier, 15.006.30523 and earlier

Timeline

  • 2020-08-19: advisory: Initial NVD publication
  • 2020-08-11: patched: Adobe released security bulletin APSB20-48
  • 2026-04-13: kev added: CISA added to Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.