CVE-2023-21608
Adobe Acrobat and Reader Use-After-Free Vulnerability
Description
CVE-2023-21608 is a high-severity use-after-free vulnerability in Adobe Acrobat Reader that could allow an attacker to execute arbitrary code on the victim's system. The vulnerability affects Adobe Acrobat DC versions 22.003.20282 and earlier, Adobe Acrobat Reader DC versions 22.003.20281 and earlier, and Adobe Acrobat Reader versions 20.005.30418 and earlier. Exploitation requires user interaction — a victim must open a specially crafted malicious file for the use-after-free condition to trigger, enabling code execution in the context of the current user. CISA has confirmed active exploitation of this Adobe Acrobat Reader vulnerability and added CVE-2023-21608 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 84.1% indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat dc | >= 15.008.20082, <= 22.003.20282; >= 15.008.20082, <= 22.003.20281 |
| adobe | acrobat reader dc | >= 15.008.20082, <= 22.003.20282; >= 15.008.20082, <= 22.003.20281 |
| adobe | acrobat | >= 20.001.30005, <= 20.005.30418 |
| adobe | acrobat reader | >= 20.001.30005, <= 20.005.30418 |
References
- https://helpx.adobe.com/security/products/acrobat/apsb23-01.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21608(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
A use-after-free vulnerability occurs when a program continues to reference memory after it has been freed, allowing an attacker to manipulate that memory region to execute arbitrary code or cause other unintended behavior. In CVE-2023-21608, Adobe Acrobat Reader improperly handles memory during document processing, enabling an attacker to craft a malicious file that triggers the use-after-free condition upon opening.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-21608 carries a CVSS score of 7.8 (High), indicating significant security risk. The vulnerability requires local access, meaning an attacker must deliver a malicious file to the victim, but exploitation itself is easy with no special conditions needed (low attack complexity) and no authentication is required. User Interaction (Required): the victim must open the malicious file, which serves as the only barrier to exploitation. Confidentiality (High): successful exploitation allows the attacker to read sensitive data accessible to the current user. Integrity (High): arbitrary code execution enables modification of files and system settings. Availability (High): the attacker can crash the application or disrupt system operations. With an EPSS score of 84.1% indicating a very high likelihood of exploitation, organizations using Adobe Acrobat or Acrobat Reader should prioritize patching immediately.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-21608 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 84.1% indicates a very high probability of exploitation, placing this vulnerability in the 99th percentile. While the ransomware association for CVE-2023-21608 is currently listed as unknown, the use-after-free nature of the vulnerability and the widespread deployment of Adobe Acrobat Reader make it a high-value target for threat actors distributing malicious PDF documents.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Adobe has released security updates addressing this vulnerability in APSB23-01 — update Adobe Acrobat DC, Acrobat Reader DC, and Acrobat Reader to the latest available versions.
- Upgrade Adobe Acrobat DC beyond version 22.003.20282, Acrobat Reader DC beyond version 22.003.20281, and Acrobat Reader 2020 beyond version 20.005.30418 to patched releases as specified in the Adobe security bulletin.
- Implement email and web gateway filtering to block or quarantine suspicious PDF attachments and downloads. Configure endpoint protection solutions to scan PDF files before they are opened by Adobe Acrobat Reader.
- Enable Protected View and Enhanced Security in Adobe Acrobat Reader settings to restrict potentially dangerous actions when opening files from untrusted sources. This limits the impact of exploitation by sandboxing document processing.
- Monitor endpoints for suspicious process behavior originating from Adobe Acrobat Reader processes, such as unexpected child process creation, unusual memory access patterns, or attempts to write to system directories. Review security logs for indicators of compromise related to PDF-based attacks.
Technical Details
CVE-2023-21608 is a use-after-free vulnerability (CWE-416) in Adobe Acrobat Reader where the application references a memory region after it has been deallocated during document processing. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that while the attack vector is local — requiring the victim to open a malicious file — the exploitation complexity is low and no special privileges are needed. When a victim opens a crafted document, the use-after-free condition allows an attacker to corrupt memory in a controlled manner, redirecting execution flow to achieve arbitrary code execution in the context of the current user. The scope remains unchanged, meaning the exploit impacts only the Adobe Acrobat Reader process and resources accessible to the current user, but with high impact across confidentiality, integrity, and availability, this effectively grants the attacker the same level of system access as the victim.
Frequently Asked Questions
Is CVE-2023-21608 being actively exploited?
Yes, CVE-2023-21608 is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 84.1% confirms a very high probability of exploitation, though ransomware association is currently listed as unknown.
What products are affected by CVE-2023-21608?
CVE-2023-21608 affects Adobe Acrobat DC versions 22.003.20282 and earlier, Adobe Acrobat Reader DC versions 22.003.20281 and earlier, and Adobe Acrobat Reader versions 20.005.30418 and earlier. Both the standard Acrobat product and the free Acrobat Reader are impacted across all platforms.
How do I fix CVE-2023-21608?
Apply the security updates provided by Adobe in bulletin APSB23-01 by updating to the latest version of Adobe Acrobat DC, Acrobat Reader DC, or Acrobat Reader 2020. As interim protection, enable Protected View and Enhanced Security settings within Adobe Acrobat Reader and implement email gateway filtering to block suspicious PDF attachments.
How severe is CVE-2023-21608?
CVE-2023-21608 is rated High severity with a CVSS score of 7.8 out of 10.0, reflecting the potential for arbitrary code execution when a victim opens a malicious file. It ranks in the 99th percentile for exploitation probability (EPSS score of 84.1%), indicating that exploitation is very likely. The vulnerability enables full compromise of the user's session, affecting confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.