Out-of-bounds write in Adobe Reader and Adobe Acrobat - CVE-2023-26369
Published: September 12, 2023
Vulnerability identifier: #VU80642
CSH Severity: Critical
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26369
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing PDF. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Adobe Reader
Adobe Acrobat
Adobe Acrobat
How to mitigate CVE-2023-26369
Install updates from vendor's website.
Adobe Reader - addressed in versions 20.005.30524, 23.006.20320
Adobe Acrobat - addressed in versions 20.005.30524, 23.006.20320
Adobe Acrobat - addressed in versions 20.005.30524, 23.006.20320