US cybersecurity agency warns of actively exploited Adobe Acrobat Reader vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat…
The US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat Reader to its Known Exploitable Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Tracked as CVE-2023-21608 (CVSS score: 7.8), the vulnerability is described as a use-after-free bug that can be exploited to achieve remote code execution (RCE) with the privileges of the current user.
A patch for the flaw was released by Adobe in January 2023. HackSys security researchers Ashfaq Ansari and Krishnakant Patil were credited with discovering and reporting the flaw.
The following versions of software are affected –
Details regarding the nature of the exploit and the threat actors that exploits CVE-2023-21608 are currently unknown. A proof-of-concept (POC) exploit for the flaw was made available in late January 2023.
CVE-2023-21608 is also the second Adobe Acrobat and Reader vulnerability that has seen in-the-wild exploitation after CVE-2023-26369, an out-of-bounds write issue that could result in code execution by opening a specially crafted PDF document.
Federal Civilian Executive Branch (FCEB) agencies are required to apply vendor-provided patches by October 31, 2023, to secure their networks against potential threats.
The US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat…
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Read More