CVE-2023-26369
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
Published Sep 13, 2023 · updated Jun 16, 2026 · adobe acrobat
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Timeline
Detection, updates, and resolution for this record.
Sep 13, 2023 · Catalog
Detected
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Sep 14, 2023 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 5, 2023 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 5, 2023
Affected
- cpe adobe/acrobatversion unspecified
- cpe adobe/acrobat dcversion unspecified
- cpe adobe/acrobat readerversion unspecified
- cpe adobe/acrobat reader dcversion unspecified
- vendor Adobe Acrobat and Readerversion unspecified
Sources
- CISA KEVCVE-2023-26369
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
cisa.gov - CVE.orgCVE-2023-26369
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-26369
30-day exploitation probability 6.7%
first.org - NIST NVDCVE-2023-26369
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires
nvd.nist.gov