Introduction
Attackers can exploit a single malicious PDF to gain code execution on endpoints running vulnerable versions of Adobe Acrobat Reader. Acrobat Reader is deployed on hundreds of millions of systems globally, so this vulnerability is a significant risk for enterprises and individuals who rely on PDF workflows for daily operations.
Technical information
CVE-2025-54257 is a Use After Free vulnerability (CWE-416) in Adobe Acrobat Reader. When the application processes certain PDF structures, it keeps referencing memory after that memory has been freed. An attacker can craft a malicious PDF file that triggers this condition, so the application accesses or executes data from freed memory. If the attacker can control what the freed memory contains, the result can be arbitrary code execution in the context of the current user.
Exploitation requires user interaction. The victim must open the malicious PDF file. The attacker manipulates the heap layout so that attacker-controlled data ends up in the freed memory region. When the vulnerable code path is triggered, the application may execute attacker-supplied code. Both the Windows and macOS versions of Acrobat Reader are affected.
As of the publication date, no public code snippets or detailed exploit chains have been released for this vulnerability.
Affected systems and versions
- Adobe Acrobat Reader 24.001.30254 and earlier
- Adobe Acrobat Reader 20.005.30774 and earlier
- Adobe Acrobat Reader 25.001.20672 and earlier
Any configuration of these versions is vulnerable if it processes untrusted PDF files.
Vendor security history
Adobe has a long history of memory corruption vulnerabilities in Acrobat Reader, especially Use After Free bugs in the PDF rendering engine. In 2025 alone, several similar vulnerabilities have been reported and patched. Adobe follows a regular patch cycle and coordinates with security researchers and vendors to fix these issues. The same class of bug keeps coming back, which shows that secure memory management in complex document-parsing code is still an unsolved problem.
