CVE-2023-21608
Estado: AnalizadaAlta (7.8)⚠ Explotación activa
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 61%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 1/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 10/10/2023
- Plazo de remediación: 31/10/2023
- Uso conocido en ransomware: Unknown
Tecnologías afectadas (4)
CWE
- CWE-416
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-21608",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-21608",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-04T16:09:17.035410Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "psirt@adobe.com",
"affectedData": [
{
"vendor": "Adobe",
"product": "Acrobat Reader",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "20.005.30418"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "22.003.20282"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "22.003.20281"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "None"
}
]
}
]
}
],
"published": "2023-01-18T19:15:11.877",
"references": [
{
"url": "https://helpx.adobe.com/security/products/acrobat/apsb23-01.html",
"tags": [
"Vendor Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "https://helpx.adobe.com/security/products/acrobat/apsb23-01.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21608",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
},
{
"lang": "es",
"value": "Las versiones de Adobe Acrobat Reader 22.003.20282 (y anteriores), 22.003.20281 (y anteriores) y 20.005.30418 (y anteriores) se ven afectadas por una vulnerabilidad Use After Free que podría provocar la ejecución de código arbitrario en el contexto del usuario actual. La explotación de este problema requiere la interacción del usuario, ya que la víctima debe abrir un archivo malicioso."
}
],
"lastModified": "2026-06-17T05:33:17.210",
"cisaActionDue": "2023-10-31",
"cisaExploitAdd": "2023-10-10",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14754E74-395C-4EF7-B0F0-F377AFE9889E",
"versionEndIncluding": "22.003.20282",
"versionStartIncluding": "15.008.20082"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB7101F6-21E8-4B8D-84AE-733503EDA65E",
"versionEndIncluding": "22.003.20282",
"versionStartIncluding": "15.008.20082"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF3A489A-5635-482A-A61F-5734417F8518",
"versionEndIncluding": "22.003.20281",
"versionStartIncluding": "15.008.20082"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5B5460B-C186-4A90-B28E-EEAC8A154E7A",
"versionEndIncluding": "22.003.20281",
"versionStartIncluding": "15.008.20082"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EA7F4CB-565E-4CAA-BDB7-9B04141D5D72",
"versionEndIncluding": "20.005.30418",
"versionStartIncluding": "20.001.30005"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*",
"vulnerable": true,
"matchCriteriaId": "392735BD-1019-4F4F-B477-64CF254A64AF",
"versionEndIncluding": "20.005.30418",
"versionStartIncluding": "20.001.30005"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@adobe.com",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Adobe Acrobat and Reader Use-After-Free Vulnerability"
}