{"id":"CVE-2023-26369","aliases":["EUVD-2023-30189","GHSA-pxpg-54ph-g5gh"],"status":"published","title":"[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild","description":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.07458,"percentile":0.94545,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-09-13T08:17:43Z","modified":"2026-06-17T05:43:11Z","kev":{"date_added":"2023-09-14","due_date":"2023-10-05","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-09-14"},{"source":"kev","since":"2023-09-14"}],"products":[{"vendor":"adobe","product":"acrobat"},{"vendor":"adobe","product":"acrobat and reader"},{"vendor":"adobe","product":"acrobat reader"},{"vendor":"adobe","product":"acrobat_dc"},{"vendor":"adobe","product":"acrobat_reader"},{"vendor":"adobe","product":"acrobat_reader_dc"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb23-34.html","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26369","tags":["government-resource","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26369"},{"url":"https://github.com/advisories/GHSA-pxpg-54ph-g5gh"}],"sources":{"cve":[{"id":"CVE-2023-26369","title":"[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild","description":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","status":"published","published":"2023-09-13T08:17:43.954Z","modified":"2025-10-21T23:05:37.994Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-30189","description":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","status":"published","published":"2023-09-13T08:17:43Z","modified":"2025-10-21T23:05:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2023-09-14","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-pxpg-54ph-g5gh","title":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 ...","description":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","status":"published","published":"2023-09-13T09:30:20Z","modified":"2025-10-22T00:32:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-26369","title":"Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability","description":"Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.","cwes":["CWE-787"],"kev":{"date_added":"2023-09-14","due_date":"2023-10-05","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-26369","description":"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","status":"published","published":"2023-09-13T09:15:13.007Z","modified":"2026-06-17T05:43:11.17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:28.268644Z"}]}}