Description
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide malicious XML input containing a reference to an external entity, potentially leading to unauthorized read access outside the Acrobat sandbox. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Acrobat Reader | ≤ 20.005.30710 | — |
Advisories 2
- NCSC-2024-0482 Kwetsbaarheden verholpen in Adobe Acrobat Reader NCSC-NL (Netherlands) · Dec 11, 2024
- WID-SEC-2024-3662 Adobe Acrobat und Acrobat Reader: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 10, 2024
References
- https://helpx.adobe.com/security/products/acrobat/apsb24-92.html vendor-advisory