CVE-2023-21608 is a vulnerability in Adobe Acrobat
Published on January 18, 2023
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Known Exploited Vulnerability
This Adobe Acrobat and Reader Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
The following remediation steps are recommended / required by October 31, 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2023-21608 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2023-21608 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2023-21608
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-21608 are published in Adobe Acrobat:
Affected Versions
Adobe Acrobat Reader:- Version unspecified, <= 20.005.30418 is affected.
- Version unspecified, <= 22.003.20282 is affected.
- Version unspecified, <= 22.003.20281 is affected.
- Version unspecified, <= None is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.