cbcvebase.
CVE-2023-26369
published 2023-09-13

CVE-2023-26369: Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write…

PriorityP183high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2023-10-05
Exploited in the wild
EPSS
7.04%
93.5th percentile
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

5 ranges
VendorProductVersion rangeFixed in
adobeacrobat>= 20.001.3005 < 20.005.3052420.005.30524
adobeacrobat_dc>= 15.007.20033 < 23.006.2032023.006.20320
adobeacrobat_reader<= 20.005.30514
adobeacrobat_reader>= 20.001.3005 < 20.005.3052420.005.30524
adobeacrobat_reader_dc>= 15.007.20033 < 23.006.2032023.006.20320

Detection & IOCsextracted from sources · hover to see the quote

otherCVE-2023-26369 / APSB23-34
  • Check Point IPS signature available for detection: 'Adobe Acrobat and Reader Out-of-bounds Write (APSB23-34: CVE-2023-26369)'
  • Exploitation requires a victim to open a specially crafted (malicious) PDF document — monitor for suspicious PDF opens in Adobe Acrobat/Reader processes leading to unexpected child process spawning or memory writes.
  • Exploitation requires user interaction; the attack vector is a malicious file (PDF). Alert on Adobe Acrobat/Reader versions at or below 23.003.20284 (Win/Mac), 23.003.20244 (Win), 20.005.30516 (Mac), 20.005.30514 (Win) opening externally sourced PDFs.
  • CISA KEV listing confirms active exploitation in the wild — prioritize detection on all Adobe Acrobat and Reader deployments.
  • ·All four Acrobat/Reader product tracks are affected; ensure version checks cover both Windows and macOS builds as version numbers differ by platform.
  • ·CISA mandated remediation deadline was 2023-10-05; any unpatched asset past this date should be treated as high-priority risk.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.