CVE-2025-64785CWE-426

CVE-2025-64785

High · published December 10, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

⚡ A sneaky untrusted search path in Adobe Acrobat Reader could let attackers execute arbitrary code, all thanks to a wrongly pointed search path! 🔍 Think of it like a restaurant menu that points to the wrong dish — if the chef follows it, you might end up with a surprise from the dumpster instead of your ordered meal! 🍽️ This vulnerability allows an attacker to run their own malicious code as the current user, potentially leading to devastating consequences like data theft, system takeover, or unauthorized access to sensitive information. The catch? The user needs to open a specially crafted file to trigger the exploit, making this a dangerous game of trust! 😱

Put simply

Think of it like a restaurant menu that points to the wrong dish — if the chef follows it, you might end up with a surprise from the dumpster instead of your ordered meal! 🍽️ This vulnerability arises from an untrusted search path in Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, and earlier, allowing an attacker to manipulate the program's search path to execute harmful code disguised as legitimate resources.

What to do

This vulnerability allows an attacker to run their own malicious code as the current user, potentially leading to devastating consequences like data theft, system takeover, or unauthorized access to sensitive information. The catch? The user needs to open a specially crafted file to trigger the exploit, making this a dangerous game of trust! 😱 To guard against this threat, make sure to update your Adobe Acrobat Reader to the latest version immediately. Encourage users to be cautious with files from unknown sources, and consider disabling automatic file execution features where possible. 🔒 You've got this! Stay vigilant, and together we can keep our systems safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-12-10T02:15Z
Affected products (6)
ProductVersionsFixed in
adobe/acrobat≥ 20.001.3005, < 20.005.3083820.005.30838
adobe/acrobat_dc< 25.001.2099725.001.20997
adobe/acrobat_reader≥ 20.001.3005, < 20.005.3083820.005.30838
adobe/acrobat_reader_dc< 25.001.2099725.001.20997
adobe/acrobat≥ 24.001.20604, < 24.001.3030724.001.30307
adobe/acrobat≥ 24.001.20604, < 24.001.3030824.001.30308
References (1)
EPSS history
Timeline
  • 09 DEC 20:21Z
    Acrobat Reader | Untrusted Search Path (CWE-426)
    cvelistv5