CVE-2020-9715
Published 2020-08-19 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2020-9715 is a high-severity (CVSS 7.8) vulnerability in Adobe Acrobat. CISA added it to the Known Exploited Vulnerabilities catalog on April 13, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 27, 2026. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Acrobat
Name: Adobe Acrobat Use-After-Free Vulnerability
Date added: 2026-04-13 · Due: 2026-04-27
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/
- https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/
- https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-991/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715