⚠ Actively exploited
Added to CISA KEV on 2023-10-10. Federal agencies required to patch by 2023-10-31. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..
CVE-2023-21608 — Use After Free in Adobe Acrobat Reader
Severity
7.8HIGHNVD
EPSS
79.1%
top 0.93%
CISA KEV
KEV
Added 2023-10-10
Due 2023-10-31
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJan 18
KEV addedOct 10
KEV dueOct 31
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9