CVE-2025-64786

Dec. 12, 2025, 7:36 p.m.

3.3
Low

Description

Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited unauthorized write access. Exploitation of this issue does not require user interaction.

Product(s) Impacted

Vendor Product Versions
Adobe
  • Acrobat
  • Acrobat Dc
  • Acrobat Reader
  • Acrobat Reader Dc
  • *
  • *
  • *
  • *
Microsoft
  • Windows
  • -
Apple
  • Macos
  • -

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-347
Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a adobe acrobat / / / / classic / / /
a adobe acrobat_dc / / / / continuous / / /
a adobe acrobat_reader / / / / classic / / /
a adobe acrobat_reader_dc / / / / continuous / / /
a adobe acrobat / / / / classic / / /
o microsoft windows - / / / / / / /
a adobe acrobat / / / / classic / / /
o apple macos - / / / / / / /

References

https://helpx.adobe.com/security/products/acrobat/apsb25-119.html

Tags

CWE-347
psirt@adobe.com
2025-12-09
CVE-2025-64786

CVSS Score

3.3 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: Dec. 9, 2025, 9:15 p.m.
Last Modified: Dec. 12, 2025, 7:36 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

psirt@adobe.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.