CVE-2024-20721
T5 Acrobat JS vulnerability - Exploitable crash via t5::javascript::get_page_num_words
Reported by adobe · Published January 15, 2024
Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| edge_chromium | microsoft | 120.0.2210.133 |
| Acrobat for Edge | Adobe | 120.0.2210.91 |
| acrobat | adobe | 120.0.2210.91 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat for Edge | 0 |
| Adobe | Acrobat for Edge | 0 |
Timeline
- Jan 11, 2024 CVE Published
- Jan 18, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (7 in total, the first dated here)
- Jun 3, 2025 CVE Updated
- Mar 11, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-20721
vulnetix vdb fixes CVE-2024-20721Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-20721/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart