CVE-2025-54255: acrobat — Fix

Description

Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass impacting integrity. An attacker does not have to be authenticated. Exploitation of this issue does not require user interaction, and scope is unchanged.

Is your site exposed to CVE-2025-54255?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.0

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-657 CWE-657

Affected Products

Vendor	Product	Versions
adobe	acrobat	24.0.0 — 24.001.30264
adobe	acrobat_dc	15.008.20082 — 25.001.20693
adobe	acrobat_reader_dc	15.008.20082 — 25.001.20693
apple	macos	All
microsoft	windows	All
adobe	acrobat	20.001.30002 — 20.005.30793
adobe	acrobat_reader	20.001.30002 — 20.005.30791
microsoft	windows	All
adobe	acrobat	20.001.30002 — 20.005.30791
adobe	acrobat_reader	20.001.30002 — 20.005.30791
apple	macos	All

References

Advisories & Patches

https://helpx.adobe.com/security/products/acrobat/apsb25-85.html

Frequently Asked Questions

What is CVE-2025-54255? +

Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass impacting integrity. An attacker does not have to be authenticated. Exploitation of this issue does not require user interaction, and scope is unchanged. It has a CVSS v3.1 base score of 4.0 (MEDIUM).

How severe is CVE-2025-54255? +

CVE-2025-54255 has a CVSS v3.1 score of 4.0 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-54255? +

CVE-2025-54255 affects products from adobe, apple, microsoft, specifically: acrobat, acrobat_dc, acrobat_reader, acrobat_reader_dc, macos, windows. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-54255? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-26139 8.3

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack …

CVE-2023-52714 7.5

Vulnerability of defects introduced in the design process in the hwnff module. Impact: Successful exploitation of this vulnerability may affect …

CVE-2024-57957 6.6

Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service …

CVE-2024-33849 6.5

ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.

CVE-2025-24887 6.3

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can …

CVE-2024-30299 10.0

Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Improper Authentication vulnerability that could result in …

CVE-2025-54255