Security Resilience

CVE-2023-38226

Memory Safety in Adobe Acrobat 20.001.30005 – 20.005.30516.10516

Memory Safety
Published
10 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.031 87th percentile
Risk Priority 64 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-38226 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked in the top 13% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Adobe Acrobat Reader versions 23.003.20244 and earlier, along with versions 20.005.30467 and earlier, are affected by an Access of Uninitialized Pointer vulnerability tracked as CVE-2023-38226 and assigned CWE-824. The flaw can result in arbitrary code execution in the context of the current user and is rated 7.8 under CVSS 3.1.

An attacker can exploit the issue by supplying a malicious file that a victim must open, after which the uninitialized pointer dereference may be triggered to achieve code execution on the target system. No elevated privileges are required beyond the ability to induce the user interaction.

The Adobe security advisory at https://helpx.adobe.com/security/products/acrobat/apsb23-30.html describes available patches and mitigation guidance for affected Acrobat Reader installations.

EPSS remains flat at a peak and current value of 0.0537 with no material upward trajectory after disclosure.

EU & UK References

Vulnerability Data

Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…

more

interaction in that a victim must open a malicious file.

CWE(s)
CWE-824

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-38234Same product: Adobe Acrobat
CVE-2025-27162Same product: Adobe Acrobat
CVE-2025-27158Same product: Adobe Acrobat
CVE-2023-44365Same product: Adobe Acrobat
CVE-2023-38246Same product: Adobe Acrobat
CVE-2023-38223Same product: Adobe Acrobat
CVE-2023-22241Same product: Adobe Acrobat
CVE-2023-22240Same product: Adobe Acrobat
CVE-2024-20726Same product: Adobe Acrobat
CVE-2024-39423Same product: Adobe Acrobat

Affected Assets

adobe
acrobat dc
15.008.20082 — 23.003.20269
adobe
acrobat reader dc
15.008.20082 — 23.003.20269
adobe
acrobat
20.001.30005 — 20.005.30516.10516 · 20.001.30005 — 20.005.30514.10514
adobe
acrobat reader
20.001.30005 — 20.005.30516.10516 · 20.001.30005 — 20.005.30514.10514

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly prevent uninitialized pointer bugs via coding standards, analysis, and reviews, but eliminating this single weakness only partially fulfills the broader control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.5.32 Intellectual property rights partial match
removes

References