PT-2023-6556 · Adobe+1 · Acrobat For Edge+1

Hao Li · Published 2023-10-27 · Updated 2023-11-08 · CVE-2023-44323

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat for Edge versions 118.0.2088.46 and earlier

Description The issue is related to a Use After Free vulnerability in the Adobe PDF component of Microsoft Edge, which can be exploited by an unauthenticated attacker to achieve an application denial-of-service in the context of the current user. This requires user interaction, where a victim must open a malicious file. The vulnerability allows a remote attacker to execute arbitrary code by opening a specially crafted PDF document in the browser.

Recommendations For Adobe Acrobat for Edge versions 118.0.2088.46 and earlier, update to a version later than 118.0.2088.46 to resolve the issue. As a temporary workaround, consider avoiding the use of Adobe Acrobat for Edge until a patch is available. Restrict access to malicious PDF files to minimize the risk of exploitation.

Fix

RCE

DoS

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

BDU:2023-07318

CVE-2023-44323

Affected Products

Acrobat For Edge

Edge

References · 8

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44323 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07318 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44323 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44323 · Vendor Advisory
• https://twitter.com/CVEnew/status/1719004428085146086 · Twitter Post
• https://twitter.com/PatrizioBytes/status/1719440118229201133 · Twitter Post
• https://t.me/cvenotify/60187 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719032676772888797 · Twitter Post