CVE-2023-26369
Published 2023-09-13 · Updated 2026-06-17 · Source psirt@adobe.com
Summary
CVE-2023-26369 is a high-severity (CVSS 7.8) vulnerability in Adobe Acrobat and Reader. CISA added it to the Known Exploited Vulnerabilities catalog on September 14, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 5, 2023. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Acrobat and Reader
Name: Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Date added: 2023-09-14 · Due: 2023-10-05
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.