CVE-2023-38224: ZDI-CAN-21122: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-38224?
CVE-2023-38224 is a Use After Free vulnerability in Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) that could lead to arbitrary code execution.
How can the vulnerability in Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) be exploited?
Exploitation of this vulnerability requires user interaction, specifically the victim must open a maliciously crafted PDF file.
What is the severity of CVE-2023-38224?
The severity of CVE-2023-38224 is high with a CVSS score of 7.8.
Are Apple macOS and Microsoft Windows affected by this vulnerability?
No, Apple macOS and Microsoft Windows are not affected by this vulnerability.
How do I fix the Use After Free vulnerability in Adobe Acrobat Reader?
To fix the vulnerability, update Adobe Acrobat Reader to version 23.003.20269 or later.