Adobe Acrobat Use-After-Free Vulnerability CVE-2020-9715
Summary
CISA added CVE-2020-9715 to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a use-after-free flaw in Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier. Successful exploitation could lead to arbitrary code execution. The SSVC assessment rates exploitation as 'active' with total technical impact.
What changed
CISA added CVE-2020-9715 to the Known Exploited Vulnerabilities catalog, identifying an actively exploited use-after-free vulnerability in Adobe Acrobat and Reader. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with attack vector local, requiring user interaction to exploit.\n\nOrganizations using affected Adobe Acrobat and Reader versions should apply available patches immediately. CISA's SSVC analysis indicates active exploitation with total technical impact, though the attack is not automatable. This KEV addition signals heightened risk and may trigger compliance review for organizations subject to cybersecurity requirements.
What to do next
- Apply available patches to affected Adobe Acrobat and Reader versions
- Check systems for presence of vulnerable Adobe Acrobat and Reader versions
- Prioritize patching given active exploitation status
Archived snapshot
Apr 14, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Required CVE Record Information
CNA: Adobe Systems Incorporated
Description
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected at 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier versions
References 3 Total
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/
CVE Program
Updated:
2024-08-04
This container includes required additional information provided by the CVE Program for this vulnerability.
References 3 Total
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/ x_transferred
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html x_transferred
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/ x_transferred
Authorized Data Publishers
CISA-ADP
Updated:
2026-04-13
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | no | total | 2.0.3 | 2026-04-13 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715 (2026-04-13)
CWE 1 Total
Learn more
- CWE-416: CWE-416 Use After Free
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 7.8 | HIGH | 3.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Related changes
Get daily alerts for CISA Known Exploited Vulnerabilities (KEV)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CISA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.