CVE-2023-21608 is a vulnerability in Adobe
Published on January 18, 2023
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Known Exploited Vulnerability
This Adobe Acrobat and Reader Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
The following remediation steps are recommended / required by October 31, 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2023-21608 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2023-21608 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2023-21608
You can be notified by stack.watch whenever vulnerabilities like CVE-2023-21608 are published in these products:
What versions of are vulnerable to CVE-2023-21608?
Each of the following must match for the vulnerability to exist.
Each of the following must match for the vulnerability to exist.
Each of the following must match for the vulnerability to exist.