CVE-2023-26369
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Description
CVE-2023-26369 is an out-of-bounds write vulnerability in Adobe Acrobat and Adobe Acrobat Reader that can result in arbitrary code execution in the context of the current user. The vulnerability affects Acrobat Reader versions 23.003.20284 and earlier, as well as Acrobat DC versions 20.005.30516 and 20.005.30514 and earlier. Exploitation requires user interaction, as a victim must open a specially crafted malicious PDF file. CISA has added CVE-2023-26369 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, though its relatively low EPSS score of 0.56% suggests exploitation may be targeted rather than widespread.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat | >= 20.001.3005, < 20.005.30524 |
| adobe | acrobat dc | >= 15.007.20033, < 23.006.20320 |
| adobe | acrobat reader | >= 20.001.3005, < 20.005.30524 |
| adobe | acrobat reader dc | >= 15.007.20033, < 23.006.20320 |
References
- https://helpx.adobe.com/security/products/acrobat/apsb23-34.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26369(Third Party Advisory, US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
The Adobe Acrobat and Reader vulnerability involves an out-of-bounds write condition where the application writes data past the boundaries of an allocated memory buffer during PDF file processing. In the context of CVE-2023-26369, this memory corruption flaw can be triggered when parsing a specially crafted PDF document, allowing an attacker to overwrite adjacent memory and potentially redirect execution flow to achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-26369 carries a CVSS v3.1 score of 7.8 (High), reflecting significant impact despite requiring local access and user interaction. The vulnerability requires local access through a malicious file rather than direct network exploitation, but attack complexity is low with no special conditions needed, and no authentication is required. User Interaction (Required): The victim must open a malicious PDF file, which can be delivered via email attachments, download links, or compromised websites. Confidentiality (High): Successful exploitation enables the attacker to access any data available to the current user, including documents, credentials, and sensitive files. Integrity (High): Arbitrary code execution allows the attacker to install malware, modify files, and persist on the compromised system. Availability (High): The attacker can disrupt user operations or leverage the compromised system for further attacks. Although the EPSS score of 0.56% suggests exploitation is not yet widespread, the confirmed active exploitation by CISA indicates targeted attacks are occurring.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-26369 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 5, 2023. No public exploit code or proof-of-concept has been identified in the available references, suggesting that exploitation may be limited to sophisticated or targeted attacks. The EPSS score of 0.56% indicates that while exploitation is possible, it is not yet widespread. The ransomware usage status is listed as Unknown, and organizations should monitor threat intelligence feeds for any escalation in exploitation activity.
Remediation
- Apply mitigations per vendor instructions as directed by CISA (remediation deadline: October 5, 2023). Install the Adobe security update documented in APSB23-34, which patches CVE-2023-26369 across all affected product lines.
- Update Adobe Acrobat and Reader to the latest available versions: upgrade Acrobat Reader beyond version 23.003.20284, and Acrobat DC beyond versions 20.005.30516 and 20.005.30514. Enable automatic updates in Adobe products to ensure timely patching of future vulnerabilities.
- Implement PDF security controls by configuring Adobe Acrobat and Reader to open files in Protected View (sandboxed mode) by default, disabling JavaScript execution in PDF files, and blocking embedded content such as Flash or multimedia objects.
- Review email security configurations to filter or quarantine PDF attachments from untrusted sources. Deploy endpoint detection and response (EDR) tools to monitor for anomalous behavior following PDF file opens, such as unexpected process creation or network connections.
- Educate users about the risks of opening PDF files from unknown or untrusted sources. Implement application whitelisting and least-privilege principles to limit the impact of arbitrary code execution in the context of the current user.
Technical Details
CVE-2023-26369 is an out-of-bounds write vulnerability (CWE-787) in the PDF parsing engine of Adobe Acrobat and Adobe Acrobat Reader. During the processing of a specially crafted PDF document, the application writes data beyond the boundaries of an allocated memory buffer, corrupting adjacent memory structures. This memory corruption can be leveraged by an attacker to achieve arbitrary code execution within the context and privilege level of the current user. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack requires local file access with user interaction (opening the malicious PDF), but once triggered, the exploit has low complexity and requires no special privileges, resulting in complete compromise of the user's session confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2023-26369 being actively exploited?
Yes, CVE-2023-26369 is being actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. While the EPSS score of 0.56% suggests exploitation is not yet widespread, targeted attacks leveraging this vulnerability have been observed.
What products are affected by CVE-2023-26369?
CVE-2023-26369 affects Adobe Acrobat, Adobe Acrobat DC, Adobe Acrobat Reader, and Adobe Acrobat Reader DC. Specifically, Acrobat Reader versions 23.003.20284 and earlier, and Acrobat DC versions 20.005.30516 and 20.005.30514 and earlier are vulnerable. Both Windows and macOS platforms are affected.
How do I fix CVE-2023-26369?
Install the Adobe security update documented in APSB23-34, which patches all affected product lines. Update to the latest versions of Adobe Acrobat and Reader and enable automatic updates. As additional protection, enable Protected View mode and disable JavaScript execution in PDF files.
How severe is CVE-2023-26369?
CVE-2023-26369 is rated High with a CVSS v3.1 score of 7.8 out of 10. While it requires user interaction (opening a malicious PDF), successful exploitation leads to arbitrary code execution. It is in the 67th percentile for exploitation probability, and CISA's confirmation of active exploitation underscores the need for prompt patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.