CVE-2025-27159
Published: 11 March 2025
Summary
CVE-2025-27159 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Acrobat. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27159 is a Use After Free vulnerability (CWE-416) affecting Adobe Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428, and earlier. Published on 2025-03-11, it could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a local attack vector with low attack complexity, no privileges required, and user interaction needed, leading to high impacts on confidentiality, integrity, and availability with unchanged scope. Attackers who can deliver a specially crafted file to a target user could achieve remote code execution upon file opening.
Adobe's security bulletin APSB25-14, available at https://helpx.adobe.com/security/products/acrobat/apsb25-14.html, details mitigation steps and patches for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7735
Vulnerability details
Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…
more
victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The Use After Free vulnerability enables arbitrary code execution when a victim opens a specially crafted malicious file, directly mapping to T1204.002 Malicious File under User Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the Use After Free vulnerability by requiring timely patching of affected Adobe Acrobat Reader versions to prevent arbitrary code execution.
Implements memory protections such as DEP and ASLR that defend against Use After Free exploits leading to code execution even if unpatched.
Deploys malicious code protection mechanisms like antivirus scanners to detect and block specially crafted malicious PDF files before or during processing.