Adobe · Acrobat and Reader
CVE-2023-26369
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
概要
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CISA: Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
対処法
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2023年10月5日
Adobeのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/05/20 | Heap-Based Buffer Overflow | Acrobat and Reader | 高 8.8 | 87% |
| 2026/04/13 | Prototype Pollution | Acrobat and Reader | 高 8.6 | 7.3% |
| 2023/10/10 | Use-After-Free | Acrobat and Reader | 高 7.8 | 59% |
| 2022/06/08 | Buffer Overflow | Acrobat and Reader | 高 7.8 | 87% |
| 2022/06/08 | Unspecified | Acrobat and Reader | 高 8.8 | 38% |
| 2022/06/08 | Universal 3D Remote Code Execution | Acrobat and Reader | 高 8.8 | 83% |
| 2022/06/08 | Use-After-Free | Acrobat and Reader | 高 7.8 | 82% |
| 2022/06/08 | Stack-Based Buffer Overflow | Acrobat and Reader | 高 7.3 | 81% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。