CVE-2023-26369
KEVAdobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Description
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedSep 13, 2023
Last modifiedJun 17, 2026
Added to KEVSep 14, 2023
Remediation dueOct 5, 2023
References
- helpx.adobe.com/security/products/acrobat/apsb23-34.htmlVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26369Third Party AdvisoryUS Government Resource
0 recent articles mention this CVE
70
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1119 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 6.7% · top 6% of all CVEs
- Weakness
- CWE-787
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.