CVE-2023-26369
Memory Safety in Adobe Acrobat 20.001.3005 – 20.005.30524
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-26369 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Acrobat. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Acrobat Reader versions 23.003.20284 and earlier, 20.005.30516 and earlier, and 20.005.30514 and earlier contain an out-of-bounds write vulnerability, tracked as CWE-787, that can lead to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 score of 7.8 with an attack vector of local access, low complexity, no privileges required, and required user interaction.
An attacker can exploit the issue by supplying a malicious file that a victim must open, after which code executes under the privileges of the user who opened the document. No remote or unauthenticated vector is described.
Adobe’s security bulletin APSB23-34 addresses the vulnerability and directs users to apply the vendor-supplied updates. The entry also appears in CISA’s catalog of known exploited vulnerabilities.
EPSS for the CVE rose sharply from a low baseline to a peak of 0.1737 on 16 September 2023, three days after disclosure, before receding to the current value of 0.0078; this trajectory indicates a transient surge in exploitation interest following public release.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30189
Vulnerability Data
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
more
interaction in that a victim must open a malicious file.
- CWE(s)
- KEV Date Added
- 14 September 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.