Adobe has released critical security updates addressing multiple vulnerabilities affecting Acrobat and Reader on Windows and macOS.
Released on December 9, 2025, security bulletin APSB25-119 details four vulnerabilities, including two critical flaws that could allow attackers to execute arbitrary code on affected systems.
The vulnerabilities pose significant risks to enterprise and individual users. Two critical CVE entries enable arbitrary code execution via untrusted search paths and out-of-bounds reads, while two additional moderate-severity issues involve improper cryptographic signature verification.
Adobe has not identified any active exploitation in the wild at this time, but organizations should prioritize patching given the severity of the code execution vulnerabilities.
The critical vulnerabilities affect all current versions of Acrobat DC and Reader DC Continuous Track through version 25.001.20982, as well as classic versions including Acrobat 2024, 2020, and Reader 2020.
Users can update manually via Help > Check for Updates, enable automatic updates, or download the latest installer from Adobe’s official portal.
Vulnerability Details
| CVE ID | Vulnerability Type | Impact | Severity | CVSS Score |
|---|---|---|---|---|
| CVE-2025-64785 | Untrusted Search Path | Arbitrary code execution | Critical | 7.8 |
| CVE-2025-64899 | Out-of-bounds Read | Arbitrary code execution | Critical | 7.8 |
| CVE-2025-64786 | Improper Verification of Cryptographic Signature | Security feature bypass | Moderate | 3.3 |
| CVE-2025-64787 | Improper Verification of Cryptographic Signature | Security feature bypass | Moderate | 3.3 |
Adobe recommends immediate updates to the following patched versions: Acrobat DC Continuous to 25.001.20997 and Reader DC Continuous to 25.001.20997 (both Windows and macOS).
Acrobat 2024 users should update to version 24.001.30307 on Windows or 24.001.30308 on macOS. Acrobat 2020 and Reader 2020 users require version 20.005.30838 on both platforms.
End users can access updates through three primary methods: the in-application update checker, automatic update mechanisms, or the Adobe Reader Download Center.
IT administrators managing enterprise deployments should utilize their preferred deployment methodology, including AIP-GPO, bootstrapper, SCUP/SCCM for Windows environments, or Apple Remote Desktop and SSH for macOS deployments.
Security teams should prioritize patching Acrobat DC users first, followed by classic track users, given the widespread adoption of these applications in business environments.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Update
%20(1).webp?fit=1600,900&ssl=1&description=Released on December 9, 2025, security bulletin APSB25-119 details four vulnerabilities, including two critical flaws that could allow attackers to execute arbitrary code on affected systems.){kind=link}