Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 13, 2023 · Catalog

   Detected

   Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

2. Sep 14, 2023 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Oct 5, 2023 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

• cpe adobe/acrobatversion unspecified
• cpe adobe/acrobat dcversion unspecified
• cpe adobe/acrobat readerversion unspecified
• cpe adobe/acrobat reader dcversion unspecified
• vendor Adobe Acrobat and Readerversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-26369

  Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-26369

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-26369

  30-day exploitation probability 6.7%

  first.org
• NIST NVDVulnerability recordCVE-2023-26369

  Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires

  nvd.nist.gov

References

• CISA note · helpx.adobe.com
• CISA note · nvd.nist.gov
• Third Party Advisory · cisa.gov