CVE-2023-21608
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
Adobe Acrobat and Reader Use-After-Free Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA notes
https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://nvd.nist.gov/vuln/detail/CVE-2023-21608
Description
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- CISA added CVE-2023-21608 to the KEV catalog 265 days after its CVE record was published. The median for entries added in 2023 is 12 days.
- It is one of 82 Adobe entries in the CISA KEV catalog, and one of 6 added in 2023.
- Its current EPSS score (59.6%) is higher than that of 53% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Adobe Acrobat Reader | unspecified to 20.005.30418 unspecified to 22.003.20282 unspecified to 22.003.20281 unspecified to None |
References
1 LinksRecord Details
More from Adobe
Adobe Reader and Acrobat Input Validation Vulnerability
Adobe Acrobat and Reader Buffer Overflow Vulnerability
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.