On November 27, 2023, the Zero Day Initiative (ZDI) disclosed sixteen zero-day vulnerabilities in Adobe Acrobat Reader DC.
CVE-2023-44371, identified as a Use-After-Free vulnerability in Adobe Acrobat Reader DC, poses a critical threat, allowing potential arbitrary code execution in the context of the current user. The affected versions include 23.006.20360 and earlier, as well as 20.005.30524 and earlier.
Exploitation of this vulnerability requires user interaction, ie. it needs the victim to open a malicious file.
Adobe has outlined affected software versions:
Adobe Acrobat DC:
Versions between >=15.008.20082 and <23.006.20380
Adobe Acrobat Reader DC:
Versions between >=15.008.20082 and <23.006.20380
Apple macOS
Microsoft Windows
Adobe Acrobat:
Versions between >=20.001.30005 and <=20.005.30539
Adobe Acrobat Reader:
Versions between >=20.001.30005 and <20.005.30539
The severity of CVE-2023-44371 is rated at 7.8 (High).
For further details and mitigation measures, Adobe's Security Bulletin APSB23-54 provides additional information.
