CVE-2023-38227

Deeper analysis

Adobe Acrobat Reader versions 23.003.20244 and earlier, along with versions 20.005.30467 and earlier, contain a use-after-free vulnerability tracked as CVE-2023-38227 and CWE-416. The flaw can be triggered when the application processes specially crafted PDF content, leading to arbitrary code execution in the context of the logged-in user. The issue carries a CVSS 3.1 base score of 7.8 reflecting local attack vector, low attack complexity, and no privileges required.

An attacker can exploit the weakness by supplying a malicious file that the victim must open; successful exploitation grants the ability to execute arbitrary code without further user interaction beyond opening the document. Because the vulnerability resides in a client-side reader that processes untrusted input, any user who opens attacker-controlled PDFs is potentially at risk.

Adobe’s security advisory APSB23-30, referenced at helpx.adobe.com, addresses the issue through updated builds that remediate the use-after-free condition; organizations are advised to apply the patches for both the 2023 and 2020 release tracks as soon as they become available.

EPSS for the CVE rose from a low baseline to a peak of 0.3023 on 2025-01-22 before receding to the current value of 0.0866, indicating a noticeable increase in observed exploitation interest well after initial disclosure.