CVE-2023-38226
Published: 10 August 2023
Summary
CVE-2023-38226 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Acrobat Reader versions 23.003.20244 and earlier, along with versions 20.005.30467 and earlier, are affected by an Access of Uninitialized Pointer vulnerability tracked as CVE-2023-38226 and assigned CWE-824. The flaw can result in arbitrary code execution in the context of the current user and is rated 7.8 under CVSS 3.1.
An attacker can exploit the issue by supplying a malicious file that a victim must open, after which the uninitialized pointer dereference may be triggered to achieve code execution on the target system. No elevated privileges are required beyond the ability to induce the user interaction.
The Adobe security advisory at https://helpx.adobe.com/security/products/acrobat/apsb23-30.html describes available patches and mitigation guidance for affected Acrobat Reader installations.
EPSS remains flat at a peak and current value of 0.0537 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-42046
Vulnerability details
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
more
interaction in that a victim must open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.