PT-2023-6416 · Adobe · Acrobat+3

Published 2023-04-11 · Updated 2023-10-11 · CVE-2023-26397

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 23.001.20094 Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat 2020 versions prior to 20.005.30442 Adobe Acrobat Reader 2020 versions 20.005.30441 and earlier

Description The issue is related to an out-of-bounds read in memory, which could allow a remote attacker to disclose protected information using a specially crafted file. This vulnerability may also enable an attacker to bypass certain mitigations, such as Address Space Layout Randomization (ASLR). Exploitation requires user interaction, where the victim must open a malicious file, potentially leading to a memory leak.

Recommendations For Adobe Acrobat versions prior to 23.001.20094, update to version 23.001.20094 or later. For Adobe Acrobat Reader versions 23.001.20093 and earlier, update to version 23.001.20094 or later. For Adobe Acrobat 2020 versions prior to 20.005.30442, update to version 20.005.30442 or later. For Adobe Acrobat Reader 2020 versions 20.005.30441 and earlier, update to version 20.005.30442 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-07132

CVE-2023-26397

Affected Products

Acrobat

Acrobat 2020

Acrobat Reader

Acrobat Reader 2020

References · 5

• https://osv.dev/vulnerability/CVE-2023-26397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26397 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb23-24.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07132 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26397 · Note