CVE-2023-21608KEV · OVERDUECWE-416

Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

High · published January 18, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.1th percentile for exploit probability.

1089
days past CISA
deadline
CVSS v3.1
7.8
EPSS
59%
Percentile
99.1
In the wild
Confirmed
What it is

🚨 A single malicious PDF could pounce on your machine, executing arbitrary code without breaking a sweat! 😱 Think of this vulnerability like a sneaky waiter in a restaurant who brings you a dish with a hidden surprise—if you take a bite without checking, you could be in for a nasty surprise! 🍽️ If an attacker tricks a user into opening a compromised PDF, they could run any code they want on the user's machine. This could lead to data theft, unauthorized access to sensitive information, or even a full system compromise! Absolutely devastating! 🔥

Put simply

Think of this vulnerability like a sneaky waiter in a restaurant who brings you a dish with a hidden surprise—if you take a bite without checking, you could be in for a nasty surprise! 🍽️ This Use After Free vulnerability in Adobe Acrobat Reader allows an attacker to manipulate memory improperly, resulting in arbitrary code execution when a specially crafted file is opened.

What to do

If an attacker tricks a user into opening a compromised PDF, they could run any code they want on the user's machine. This could lead to data theft, unauthorized access to sensitive information, or even a full system compromise! Absolutely devastating! 🔥 To protect yourself, immediately update Adobe Acrobat Reader to the latest versions (22.003.20282 or higher, or 20.005.30419 or higher). Encourage users to be cautious with files from untrusted sources! 🛡️ You've got this! Stay sharp and keep your software updated to lock down those vulnerabilities! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.59427 · 99.1th percentile
Weakness
CWE-416 · Use After Free
Published
2023-01-18T00:00Z
KEV added
2023-10-10 · due 2023-10-31
EPSS history
Timeline
  • 10 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 31
    kev
  • 18 JAN 00:00Z
    Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
    cvelistv5