f8al Exploits and Proofs of Concept

Showing 4 PoCs on this page

GitHub

f8al/PoC-CVE-2020-9715

Repository PoC1Created 2026-04-14ExploitCVE-2020-97155 files

28.6 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

A Python script that generates a PDF file designed to trigger a use-after-free vulnerability (CVE-2020-9715) in Adobe Acrobat Reader DC. The generated PDF includes embedded JavaScript that performs heap spraying and re-accesses a stale object pointer to exercise the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PDF generator for CVE-2020-9715. The code constructs a PDF that triggers a use-after-free vulnerability in Adobe Acrobat Reader DC for EDR testing. The JavaScript payload performs heap spraying and re-accesses a stale object, which is the expected exploit behavior for this CVE. No concealed executable behavior, credential theft, persistence, unrelated remote access, or other operator-directed harm is present. The binary PDF file was not analyzed, but the generator source shows no backdoor logic.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPythonJavaScript

Target softwareAdobe Acrobat Reader DC

Attack typesuse-after-freeheap spray

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that generates a PDF which, when opened, automatically executes JavaScript designed to trigger a use-after-free vulnerability. The README explicitly states the code 'triggers the vulnerability pattern' and is for 'EDR detection validation', but the generated PDF's behavior is to exercise the vulnerability, not merely scan for it. This constitutes an exploit.

README.md:9-17generate_poc.py:57-67

Requirements

Python 3 standard library to run the generator script.generate_poc.py:17-20
A vulnerable version of Adobe Acrobat Reader DC (<= 2020.009.20063) to open the generated PDF.README.md:7

Observed behavior

Generates a PDF file with an embedded JavaScript payload.generate_poc.py:136-250
The embedded JavaScript accesses a data object to populate a cache, forces garbage collection, performs a heap spray with ArrayBuffer allocations, and then re-accesses the stale cached object to trigger a use-after-free.generate_poc.py:68-133
The PDF is structured with an OpenAction that automatically executes the JavaScript when the document is opened.generate_poc.py:200-205

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique: Payload withheldThe JavaScript payload in generate_poc.py (lines 68-133) accesses dataObjects, forces garbage collection, sprays the heap with ArrayBuffers, and re-accesses the stale object to trigger the vulnerability. This matches the described CVE-2020-9715 behavior.generate_poc.py:68-133
Pdf Structure: Payload withheldThe generated PDF uses an OpenAction to execute JavaScript and includes an embedded file with an ANSI-encoded name to trigger the cache key mismatch. This is consistent with the documented vulnerability.generate_poc.py:142-205

Review boundaries

What the analysis did not establish

The generated PDF binary is not included in the text evidence; only the generator script is provided.
The artifact does not include a weaponized payload (shellcode/ROP chain) for arbitrary code execution, but it does trigger the vulnerability.
The binary PDF file (CVE-2020-9715.pdf) was flagged as binary and not analyzed; its content could differ from the generator output if the generator is not used as intended, but the generator source shows no backdoor.
Two additional text files in the repository were omitted from the evidence packet; their content is unknown.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub