CVE-2020-9715

HIGHCISA KEV

Adobe Acrobat Use-After-Free Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-9715 has a selected CVSS score of 7.8 (high); EIP currently links 2 repository PoCs. CISA lists CVE-2020-9715 in KEV.

Description

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Apr 13, 2026 · CISA
VulnCheck KEV
Listed · Apr 13, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Acrobat

Browse Adobe / Acrobat
CISAVersion data not supplied

Adobe Acrobat and Reader

Browse Adobe / Adobe Acrobat and Reader
CVE List2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier versionsaffected

Proofs of concept

2

Repository PoCs

GitHubf8al/PoC-CVE-2020-9715Repository PoCby f8al1Exploit5 files

28.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that generates a PDF file designed to trigger a use-after-free vulnerability (CVE-2020-9715) in Adobe Acrobat Reader DC. The generated PDF includes embedded JavaScript that performs heap spraying and re-accesses a stale object pointer to exercise the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PDF generator for CVE-2020-9715. The code constructs a PDF that triggers a use-after-free vulnerability in Adobe Acrobat Reader DC for EDR testing. The JavaScript payload performs heap spraying and re-accesses a stale object, which is the expected exploit behavior for this CVE. No concealed executable behavior, credential theft, persistence, unrelated remote access, or other operator-directed harm is present. The binary PDF file was not analyzed, but the generator source shows no backdoor logic.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonJavaScript
Target softwareAdobe Acrobat Reader DC
Attack typesuse-after-freeheap spray
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that generates a PDF which, when opened, automatically executes JavaScript designed to trigger a use-after-free vulnerability. The README explicitly states the code 'triggers the vulnerability pattern' and is for 'EDR detection validation', but the generated PDF's behavior is to exercise the vulnerability, not merely scan for it. This constitutes an exploit.

README.md:9-17generate_poc.py:57-67

Requirements

  • Python 3 standard library to run the generator script.generate_poc.py:17-20
  • A vulnerable version of Adobe Acrobat Reader DC (<= 2020.009.20063) to open the generated PDF.README.md:7

Observed behavior

  • Generates a PDF file with an embedded JavaScript payload.generate_poc.py:136-250
  • The embedded JavaScript accesses a data object to populate a cache, forces garbage collection, performs a heap spray with ArrayBuffer allocations, and then re-accesses the stale cached object to trigger a use-after-free.generate_poc.py:68-133
  • The PDF is structured with an OpenAction that automatically executes the JavaScript when the document is opened.generate_poc.py:200-205
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
Payload withheldThe JavaScript payload in generate_poc.py (lines 68-133) accesses dataObjects, forces garbage collection, sprays the heap with ArrayBuffers, and re-accesses the stale object to trigger the vulnerability. This matches the described CVE-2020-9715 behavior.generate_poc.py:68-133
Pdf Structure
Payload withheldThe generated PDF uses an OpenAction to execute JavaScript and includes an embedded file with an ANSI-encoded name to trigger the cache key mismatch. This is consistent with the documented vulnerability.generate_poc.py:142-205
Review boundaries

What the analysis did not establish

  • The generated PDF binary is not included in the text evidence; only the generator script is provided.
  • The artifact does not include a weaponized payload (shellcode/ROP chain) for arbitrary code execution, but it does trigger the vulnerability.
  • The binary PDF file (CVE-2020-9715.pdf) was flagged as binary and not analyzed; its content could differ from the generator output if the generator is not used as intended, but the generator source shows no backdoor.
  • Two additional text files in the repository were omitted from the evidence packet; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHublsw29475/CVE-2020-9715Repository PoCby lsw294755Not analyzed2 files

11.0 KiB

GitHub
PoC details

References

5