What is CVE-2023-26369?

CVE-2023-26369 is a high-severity vulnerability affecting Adobe Acrobat Reader on Windows and macOS systems. This out-of-bounds write vulnerability could lead to arbitrary code execution when a user opens a malicious file. It has been exploited in limited attacks targeting Adobe Acrobat and Reader. Users are advised to update their software to the latest versions to mitigate the risk posed by this critical vulnerability.

Who is impacted?

The CVE-2023-26369 vulnerability affects users of Adobe Acrobat Reader on Windows and macOS systems. Specifically, those using Acrobat Reader versions 23.003.20284 and earlier, 20.005.30516 and earlier, and 20.005.30514 and earlier are impacted. This vulnerability could lead to arbitrary code execution when a user opens a malicious file, posing a significant risk to affected users.

What to do if CVE-2023-26369 affected you?

If you're affected by the CVE-2023-26369 vulnerability, it's crucial to take immediate action to protect your system. Follow these simple steps to mitigate the risk:

1. Update your Adobe Acrobat Reader software to the latest version. You can do this manually by selecting Help > Check for Updates, or it will update automatically when detected.

2. Be cautious when opening files from unknown sources, as the vulnerability requires user interaction with a malicious file.

3. Stay informed about security updates and best practices by regularly checking resources like the Known Exploited Vulnerabilities Catalog.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

The high-severity vulnerability CVE-2023-26369, known as Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on September 14, 2023, with a due date of October 5, 2023. To mitigate the risk, users should apply vendor-provided mitigations or discontinue using the affected product if no mitigations are available.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, an out-of-bounds write issue affecting Adobe Acrobat Reader.

Learn More

CVE-2023-26369 is a critical vulnerability affecting Adobe Acrobat Reader, with potential for arbitrary code execution. Users should take immediate action to update their software and follow best practices to mitigate risks. For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.

• Adobe Security Bulletin

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog