CVE-2023-29320highCWE-657

CVE-2023-29320: high-severity vulnerability in Adobe Acrobat Reader

ZDI-CAN-20712: Adobe Acrobat Blacklist Bypass Design flaw

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 6.0%
exploitation probability
6.0%top 7% of all CVEs
observed exploitation
nono source reports it
In short

Adobe Acrobat Reader has a security bypass that allows attackers to run malicious code on your computer by getting you to open a specially crafted PDF file. The software's built-in safety restrictions can be circumvented to execute harmful commands.

Technical detail

A design flaw in Adobe Acrobat Reader (versions 23.003.20244 and earlier, 20.005.30467 and earlier) allows attackers to bypass API blacklist restrictions, enabling arbitrary code execution in the user's context. The attack vector requires social engineering to trick a user into opening a malicious PDF file; once opened, the blacklist bypass permits execution of otherwise restricted APIs.

Summary generated and translated by AI from the official description.
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user by bypassing the API blacklisting feature. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · Acrobat Reader
Related CVEs — Adobe Acrobat Reader

In the same product, most dangerous first.

CVE-2021-21017HIGHAcrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 86.3%KEVCVE-2023-21608HIGHAdobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityEPSS 61.5%KEVCVE-2021-28550CRITICALAdobe Acrobat Reader use after free vulnerability could lead to arbitrary code executionEPSS 51.9%KEVCVE-2023-26369HIGH[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildEPSS 6.7%KEVCVE-2021-39843HIGHAdobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityEPSS 76.7%CVE-2021-39836HIGHAdobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityEPSS 69.5%
References
https://helpx.adobe.com/security/products/acrobat/apsb23-30.html