CVE-2023-26369: [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

Description

Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)6.7% · higher than 94% of CVEs

Exploited in the wildYes

CISA KEVListed Sep 14, 2023

Federal remediation dueOct 5, 2023

Ransomware campaign useNot known

Affected products

Which versions

AR

Acrobat Reader · Adobe

through 20.005.30514 · source: vendor, NVD

AC

Acrobat · Adobe

20.001.3005 before 20.005.30524 · source: NVD

AD

Acrobat DC · Adobe

15.007.20033 before 23.006.20320 · source: NVD

AR

Acrobat Reader DC · Adobe

15.007.20033 before 23.006.20320 · source: NVD

AA

Acrobat and Reader · Adobe

All versions, or not specified · source: KEV