CVE-2023-21608
Published 2023-01-18 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2023-21608 is a high-severity (CVSS 7.8) vulnerability in Adobe Acrobat and Reader. CISA added it to the Known Exploited Vulnerabilities catalog on October 10, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 31, 2023. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Acrobat and Reader
Name: Adobe Acrobat and Reader Use-After-Free Vulnerability
Date added: 2023-10-10 · Due: 2023-10-31
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.