{"id":"CVE-2023-26397","published":"2023-04-12T00:00:00Z","modified":"2025-03-05T19:07:07Z","title":"[ZS-VR-22-112] Adobe Acrobat Out-of-bounds Read Memory leak","vendor":"Adobe","product":"Acrobat Reader","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"Acrobat Reader","versions":[">= unspecified, <= 23.001.20093",">= unspecified, <= 20.005.30441",">= unspecified, <= None"]}],"description":{"text":"Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02942,"percentile":0.87132,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-06","exploitedFirstSeen":"2024-05-06","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","date":"2024-05-06"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb23-24.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-30217","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-30217","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-04-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-26397","provenance":"source"},{"date":"2024-05-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":56.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 909 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.43,"detail":"percentile 0.8713"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.85,"detail":"base score 5.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}